Apache Dubbo Remote Code Execution Vulnerability (CVE-2020-1948) Threat Alert
julho 2, 2020
Overview
Recently, Apache Dubbo was reported to contain a remote code execution vulnerability (CVE-2020-1948) resulting from deserialization.
Apache Dubbo is a high-performance Java RPC framework. The vulnerability exists in hessian, a default deserialization tool used by Apache Dubbo. An attacker may trigger it by sending malicious RPC requests which usually contain unidentifiable service or method names and some malicious parameter loads. When malicious parameters are deserialized, the attacker achieves the goal of executing code.
(mais…)
2019 Cybersecurity Insights -6
junho 30, 2020
Deserialization vulnerabilities are still frequently exploited for web attacks and special attention should be paid to the security of mainstream frameworks.
This section describes web vulnerabilities that had an extensive impact in 2019:
WebLogic
In 2017, Oracle released an official patch that fixed the XMLDecoder vulnerability (CVE-2017-10352) in WebLogic Server. This patch was evaded twice by exploits targeting two vulnerabilities (CVE-2019-2725 and CVE-2019-2729), sparking new rounds of WebLogic-targeting attacks. The two vulnerabilities reside in components built in WebLogic and could be exploited without authentication. With carefully crafted XML data in the SOAP format, an attacker could trigger the two vulnerabilities via an HTTP request. The two vulnerabilities, due to the high exploitability, are favored by hacking groups. According to statistics, after Oracle released the official security patch in April, the proof of concept (PoC) of the vulnerability (CVE-2019-2725) was publically available, encouraging a marked increase in attacks against WebLogic. Later, researchers discovered that the security patch was circumvented by an exploit (CVE-2019-2729). Obviously, the official remediation did not work, resulting in attacks reaching the culmination in May.
(mais…)2019 Cybersecurity Insights -5
junho 29, 2020
Web Attack Trend
Websites, which enterprises or individuals use to provide services for users, are usually the first choice of hackers during attacks. Web attacks in 2019 clung to traditional patterns and methods, including server information disclosure, resource leeching, cross-origin resource sharing (CORS), SQL injection, and cookie poisoning, which together accounted for 89% of web attacks. Given their high popularity, these traditional methods will continue to be a top concern for defenders.
(mais…)2019 Cybersecurity Insights -4
junho 28, 2020
Vulnerability Trend
By November 27, 2019, the National Vulnerability Database (NVD) had recorded 11,633 CVE vulnerabilities disclosed in 2019, including 6549 high-risk ones. The annual total number decreased year by year in the past three years compared with 15,881 in 2017 and 15,861 in 2018, but that of high-risk ones was on the rise.
(mais…)Microsoft’s Security Patches for June 2020 Fix 130 Security Vulnerabilities
junho 26, 2020
Overview Microsoft released the June 2020 security patches on Tuesday that fix 130 vulnerabilities ranging from simple spoofing attacks to remote code execution in various products, including Adobe Flash Player, Android App, Apps, Azure DevOps, Diagnostics Hub, HoloLens, Internet Explorer, Microsoft Browsers, Microsoft Edge, Microsoft Edge (Chromium-based) in IE Mode, Microsoft Graphics Component, Microsoft JET […]
IP Reputation Report-06212020
junho 25, 2020
1. Top 10 countries in attack counts:
The above diagram shows the top 10 regions with the most malicious IP addresses from the NSFOCUS IP Reputation databases at June 21, 2020.
(mais…)2019 Cybersecurity Insights -3
junho 24, 2020
Overall Situation Attack Type Distribution In terms of attack types 1, DDoS attracted the largest proportion (35%) of malicious IP addresses. Other types that malicious IP addresses were most interested in included spam, botnets, and scanning. Of all malicious IP addresses, 15% exploited more than one attack vector. According to our observation of such IP […]
Adobe Security Bulletins for June 2020 Security Updates
junho 23, 2020
Overview
On June 10, 2020, local time, Adobe officially released June’s security updates to fix multiple vulnerabilities in its various products, including Adobe FrameMaker, Adobe Experience Manager, and Adobe Flash Player.
For details about the security bulletins and advisories, visit the following link:
Yongyou NC Remote Command Execution Vulnerability Threat Alert
junho 22, 2020
Overview
Recently, a domestic security organization released a security advisory to announce a remote code execution vulnerability in Yongyou NC. An attacker could exploit this vulnerability to trigger a deserialization vulnerability via a crafted HTTP request, causing remote code execution on a target server.
Yongyou NC is a piece of enterprise-ready management software that is widely used in large and medium-sized enterprises. It is an IT solution informatization platform that integrates modeling, development, inheritance, operation, and management.
(mais…)