SonicWall Capture Labs Threat Research Team has observed the following threat:

  KSMBD stands for Kernel-based SMB Direct. It’s a Linux kernel module that provides the implementation of the SMBv3 protocol, allowing the Linux kernel to act as a server for SMB (Server Message Block) clients. SMB is a protocol used for sharing files, printers, and other resources between computers in a network.

  SMBv3 is the latest version of the protocol and provides several new features and improvements over previous versions, including better security features such as encryption, improved performance, and better support for large files and high-availability scenarios.

  KSMBD enables the Linux kernel to directly handle SMB requests, eliminating the need for a user-space daemon to translate the requests into kernel calls. This results in improved performance and lower overhead compared to traditional SMB implementations that rely on user-space daemons.

  A denial of service vulnerability has been reported for Linux kernel. This vulnerability is due to an integer underflow in the ksmbd_decode_ntlmssp_auth_blob function.

  A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in denial of service.

  Vendor Homepage

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2023-0210.

  CVE Listing

  The overall CVSS score is 6.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C).

  Base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is none.
    • Impact of this vulnerability on data integrity is none.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 6.7 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

  NTLMSSP is a proprietary authentication protocol used in Microsoft Windows. It involves the exchange of a series of messages between the client and the server to establish the authenticity of the client. The messages are encoded using the ASN.1 (Abstract Syntax Notation One) standard and serialized using the DER (Distinguished Encoding Rules) format. Understanding the details of NTLMSSP authentication, as well as the encoding and serialization formats used, is important for understanding this vulnerability.

  There is an integer underflow exists in the ksmbd kernel module when handling SMB2 SESSION_SETUP messages. Specifically, the flaw exists due to failure of message validation when processing the NTLMSSP authentication messages. A vulnerable function ksmbd_decode_ntlmssp_auth_blob() is responsible for handling the NTLMSSP_AUTH message. It extracts the value from Length for NTLM Response field and store it into a local variable nt_len. Then, it uses the calculation result of nt_len – CIFS_ENCPWD_SIZE(16) as the argument blen of the function ksmbd_auth_ntlmv2(). The function ksmbd_auth_ntlmv2() allocates a kernel buffer using size of blen+CIFS_CRYPTO_KEY_SIZE(8) and operates two memory copies using the size of CIFS_CRYPTO_KEY_SIZE and blen respectively.

  However, the vulnerable function failed to validate if nt_len is smaller than CIFS_ENCPWD_SIZE(16) or not. A positive value under 16 will result in an integer underflow condition. To make the memory allocation success, the value need to be in the range of 8-15. For example, if the nt_len is 12, then blen would be -4 and the memory allocation size is 4, and the later memory copy with sizes of 8 and 0xFFFFFFFC (-4) both result in the memory overflowed.

  • The vulnerable system must be listening on the vulnerable SMB port, and accept incoming connections.
  • The attacker must have connectivity to the target system.
  • The attacker must know a valid SMB user name on the target system.

  The attacker connects to the target ksmbd server. The vulnerability is triggered when the attacker sends a crafted SMB2 SESSION_SETUP request with crafted Security Blob field.

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • SMB/CIFS

  • IPS: 3510 Linux Kernel ksmbd DoS 1

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Configure the vulnerable product to allow access to trusted clients only.
    • Update to a non-vulnerable version of the product.
    • Filter attack traffic using the signature above.
  The vendor has released the following commit regarding this vulnerability:
  Vendor Advisory

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  ManageEngine is a subsidiary of Zoho Corporation that provides IT management software for businesses. The company offers a range of products for network, systems, applications, security, and service desk management. ManageEngine’s solutions aim to help organizations simplify and automate their IT operations, allowing them to focus on their core business objectives.

  Apache Santuario is an open-source implementation of the XML Security specifications. It provides a library for securing XML documents, including signing and encryption, and offers a secure and stable XML security solution. Santuario is used by various software projects, including the Apache Axis2 Web services engine, to secure their XML communications. It is apart of the Apache Software Foundation and is governed by it’s open-source community.

  A remote code execution vulnerability has been reported in multiple Zoho ManageEngine products. The vulnerability is due to an outdated version of Apache Santuario in the impacted products allowing an attacker to execute XSLT in SAML response messages.

  A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitation could result in arbitrary code execution under the security context of SYSTEM.

  Vendor Homepage

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-47966.

  CVE Listing

  The overall CVSS score is 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C).

  Base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 9.3 (E:F/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is functional.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

  Before understanding this vulnerability it’s important to research the key technologies below:

    1. SAML SSO (Security Assertion Markup Language Single Sign-On)
    2. SAML 2.0
    3. XSLT (eXtensible Stylesheet Language Transformations)
    4. Apache Xalan

  SAML SSO is a protocol that allows users to authenticate to multiple web applications using a single set of credentials. This technology provides a secure and convenient way for users to access multiple web applications with a single login, which is managed by a central identity provider. SAML SSO eliminates the need for users to remember and manage multiple sets of login credentials, which can improve the user experience and reduce the risk of password-related security breaches.

  SAML 2.0 is the latest version of the SAML standard and includes a number of improvements over SAML 1.1, making it the dominant standard for SSO. SAML 2.0 provides greater security, improved encryption and signing, and a more flexible data format, making it well-suited to a wide range of use cases. This technology is widely adopted by organizations of all sizes and is supported by a large number of identity providers and service providers.

  XSLT is a language used to transform XML (eXtensible Markup Language) documents into other formats. XSLT is used to define a set of rules for transforming the structure and content of an XML document into a different format that can be more easily displayed or processed. This technology is commonly used in conjunction with XML to create dynamic, data-driven websites, generate reports, and transform XML data into other formats for data exchange between systems. XSLT provides a powerful way to manipulate and display XML data, making it an essential tool for many XML-based applications.

  Apache Xalan is an open-source implementation of the XSLT and XML Path Language (XPath) standards. It provides a library for transforming XML documents into other formats, such as HTML, plain text, or XML with a different structure. Apache Xalan is written in Java and is part of the Apache XML Project, which is maintained by the Apache Software Foundation. This technology is widely used in a variety of applications for transforming and processing XML data, including for generating reports, transforming data for data exchange between systems, and creating dynamic, data-driven websites. Apache Xalan provides a high-performance, flexible, and easy-to-use solution for transforming XML data.

  The vulnerability is due to the server processing user XSLT transformations received in SAML responses. When an identity provider authenticates a user through SAML SSO on Key Manager Plus, it will send a request to the endpoint “/saml2” on the server and will be processed by the function service().

  Before a transformation is executed, the function checkSecureValidation() is called. This function will check if secureValidation in the Transform object is set to “true” and if the “Algorithm” attribute of the “transform” XML element is set to “http://www.w3.org/TR/1999/REC-xslt-19991116” corresponding to an XSLT transformation. If both are true, the function will throw an exception, as XSLT transformation are forbidden when secureValidation is enabled. If the checkSecureValidation() function does not throw an exception, the functions t.performTransform() and transformSpi.enginePerformTransform() will be called to execute the transform.

  The function enginePerformTransform() will be called to execute the XSLT transformation. The function will call selectNode() to find the stylesheet XML element containing the transformation. The function TransformerFactor.newInstance() is called to create a TransformerFactory object. The function setFeature() is called on the TransformerFactory object with the parameters “http://javax.xml.XMLConstants/feature/secureprocessing” and “Boolean.TRUE” to enable secure processing in Apache Xalan where the XSLT will be executed. The function transform() will be called to execute the XSLT in the transform element. However, the version of Apache Xalan included in the impacted version KeyManager Plus is vulnerable to CVE-2014-0107. This vulnerability allows an attacker to bypass some restrictions imposed by secure processing on a TransformerFactory object by using certain attributes such as “content-handler” that can load arbitrary classes, possibly leading to arbitrary code execution.

  As secureValidation in the included version of Apache Santuario is set to false by default, and secure processing can be bypassed in the included version of Apache Xalan an attacker can send a crafted SAML response to the target containing an XML “Transform” element containing an arbitrary XSLT transformation.

  • The attacker must have network access to the target server.
  • The target must be running a vulnerable version of the software.
  • The target server must have SAML SSO enabled.

  The attacker sends a crafted SAML response to the target server. The vulnerability is triggered when the server validates the response and executes XSLT in a transformation in the XML.

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTPS
    • HTTP

  Attacker Transform Payload, Executes Calc.:

  • IPS: 3481 ManageEngine products xmlsec Remote Code Execution 1
  • IPS: 3491 ManageEngine products xmlsec Remote Code Execution 2
  • IPS: 18881 ManageEngine products xmlsec Remote Code Execution 3

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Upgrading the product to a non-vulnerable version.
    • Filtering traffic based on the signatures above.
    • Disabling SAML SSO if not needed.
    • Blocking the affected ports from external network access if they’re not required.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Adobe ColdFusion is an application development platform by Adobe Systems. It is an IDE used to develop web applications and supports a full scripting language, ColdFusion Markup Language (CFML). Since ColdFusion MX 6.0, the server component runs within a Java Runtime Environment (JRE). The ColdFusion Administrator organizes information about all ColdFusion server database connections in a single location. ColdFusion provides a number of supplied drivers for connecting to multiple databases specifically the ODBC Socket.

  The ODBC Socket is the data source relevant to the understanding of this vulnerability. ODBC Socket is a type of database driver that allows applications to connect to a database using the Open Database Connectivity (ODBC) interface, but instead of connecting directly to the database, the driver connects to a server that acts as a bridge between the application and the database. The “socket,” receives the applications requests and translates them into the appropriate format for the database, and then sends the results back to the application. The use of a socket allows for greater flexibility and scalability, as the socket can be configured to connect to multiple databases, and can also be used to add security features such as encryption and authentication.

  A heap-based and stack-based buffer overflow vulnerability exists in Adobe ColdFusion ODBC Server component. This vulnerability is due the lack of proper validation of user-supplied data, which can result in a buffer overflow.

  A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted request to the target service. In the worst case, successful exploitation could result in arbitrary code execution with privileges of SYSTEM.

  Vendor Homepage

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-35711.

  CVE Listing

  The overall CVSS score is 8.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C).

  Base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 8.7 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

  It’s important to have a good understanding of the General Inter-ORB Protocol (GIOP) and the Internet Inter-ORB Protocol (IIOP) before moving further into a vulnerability that utilizes them. These protocols are used for communication between objects in a distributed system, and are based on the Common Object Request Broker Architecture (CORBA) standard. Understanding the message format and structure, as well as the different types of messages that can be sent, is essential for properly implementing and utilizing these protocols. Additionally, knowing the specific endpoint or location on the network where IIOP traffic is being sent or received is important for proper routing and communication. Without a solid understanding of GIOP and IIOP, it may be difficult to properly implement and utilize the features and functionality provided by these protocols.

  When the component receives the GIOP packet, it first calls the function swsoc.exe+0xcd070() to check that Magic Bytes field is set to “GIOP”. Next, function swsoc.exe+0xcc620() is called, which checks if ServiceContext and the Principal fields are set to 0. This function also checks that Object Key is set to “IIOP:slx::” and Operation is set to “SSP”. Next, function swsoc.exe+0xd0160() is called that checks an unknown field in the request body. The opcodes are processed, one at a time, in a loop in the function swsoc.exe+0xcd910().

  In this loop, the vulnerable opcode 8 will be examined. If the opcode is encountered, the C library function memmove() will be called that uses the OpcodeDataSize field as the size parameter to move the bytes in the Data field to a heap buffer. By supplying an OpcodeDataSize value larger than 38, the vulnerable heap-buffer will be overrun.

  • The target host must have the vulnerable version of the software installed and running.
  • The attacker must have network connectivity to the target server.

  The attacker sends a crafted GIOP request message to the ODBC Server. The GIOP message contains an overly large OpcodeDataSize value.

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • GIOP
    • IIOP
    • TCP

  • IPS: 3466 Adobe ColdFusion GIOP Heap Buffer Overflow

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Filtering network traffic using the signature above.
    • Blocking the affected ports from external network access if they are not required.
    • Updating to a non-vulnerable version of the product by applying the vendor provided patch.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory