SharePoint Vulnerability Actively Exploited; Juniper Addresses 100+ Vulnerabilities

A critical privilege elevation vulnerability in Microsoft SharePoint is reportedly being actively exploited. The vulnerability, which was patched in June, can be chained with other vulnerabilities to achieve remote code execution. The flaw, CVE-2023-29357,“allows attackers to use spoofed JSON web tokens (JWTs) to gain Administrator privileges on the SharePoint host.” The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog last week. US Federal Civilian Executive Branch agencies must address the vulnerability by January 31.

Last week, Juniper released 28 security advisories that address more than 100 vulnerabilities in multiple products. The batch of advisories includes a fix for a critical out-of-bounds write vulnerability that affects Junos OS on SRX Series and EX Series, as well as for critical flaws in third-party components used in some Juniper products.

Researchers at SentinelOne have discovered FBot, a Python-based tool that has been observed being used in attacks against web servers, cloud services, and Software as a service (SaaS) platforms. FBot’s capabilities include harvesting credentials, hijacking AWS accounts, and “functions to enable attacks against PayPal and various SaaS accounts.” SentinelOne’s write-up includes indicators of compromise.

On January 11, GitLab released critical security updates to addresses five vulnerabilities, two of which are considered critical. The first critic al flaws in an account takeover via password reset without user interaction issue; the second involved incorrect authorization checks in GitLab CE/EE and could be exploited to allow an “attacker [to] abuse Slack/Mattermost integrations to execute slash commands as another user.” The issues are addressed in GitLab versions 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

According to a report from researchers at Recorded Future’s Insikt Group, threat actors are increasingly using GitHub services for dead drop resolving and to deliver payloads, operate command-and-control systems, and exfiltrate data. The Insikt Group notes that, “There is no universal solution for GitHub abuse detection. A mix of detection strategies is needed, influenced by specific environments and factors such as the availability of logs, organizational structure, service usage patterns, and risk tolerance, among others.”

The British Library’s online services are gradually becoming available, months after the library took services offline following a ransomware attack. Users may now access the library’s online catalog in a read-only format. The British Library experienced a cybersecurity incident in late October 2023.

Researchers at Bitdefender have discovered an always-open port vulnerability in Bosch BCC101/BCC102/BCC50 Thermostats. The flaw “lets an attacker on the same network replace the device firmware with a rogue version.” Bitdefender first notified Bosch about the issue in August 2023; Bosch fixed the vulnerability in October.

Police in Ukraine, with assistance from Europol, have arrested an individual who allegedly conducted a cryptojacking campaign. The individual is believed to have mined more than EUR 1.8 million (USD 2 million) worth of virtual currency. Europol was alerted to the situation a year ago, when a cloud service provider contacted them regarding compromised user accounts.

Researchers at Trend Micro have detected a malware campaign that exploited a known security feature bypass vulnerability in Microsoft Windows Defender SmartScreen. The flaw is reportedly being used to spread malware known as Phemedrone Stealer. Microsoft released a patch for the vulnerability in November 2023 and CISA added it to the KEV catalog that same month.