Vulnerability Disclosure: Apache Privilege Escalation

On April 01 2019, Apache released a security advisory for Apache 2.4. The advisory contained 6 vulnerabilities, where 1 of them is a privilege escalation vulnerability. In versions 2.4.17 to 2.4.38, with MPM event, worker or prefork, a specifically crafted user supplied script can be executed by the Apache webserver and provide privileges of its parent process, which is usually root. This privilege escalation is serious due to the widespread use of Apache, especially on shared web hosting servers, which can give an attacker access to all of the websites hosted on the server. As of 02 April 2019, there is no proof of concept seen in the wild.

Recommendations

• If your organization runs Apache 2.4.17 to 2.4.38, update to the latest patch
• Implement custom rule in the ZeroFOX platform to monitor for reports of vulnerabilities that may affect your technical stack
• Implement a custom rule in the ZeroFOX platform to monitor for Proof of Concepts of this vulnerability and other vulnerabilities you are concerned about

Details

The Multi-Processing Module (MPM) is an Apache Module that allows requests to be served simultaneously by passing work to listener threads. The disclosure specifically states that these child processes or threads could be executing scripts by an in-process scripting interpreter which allows arbitrary code execution of the parent process. Web hosting services generally allow their customers to execute scripts as part of their service contract, so a malicious or compromised host can abuse the MPM relationship and this vulnerability to gain access to the parent process, giving the attacker access to all other websites and their data on the machine.

Breach Disclosure: Intelimost

In March 2019, techcrunch published an article about how the Intelimost spam campaign leaked over 3 Million plain text passwords and email addresses. The spammer had abandoned the server used for conducting the campaign and left the server unsecured, which contained plain text passwords and email addresses of users the spammers had compromised to run their campaign.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

On April 2, 2019 techcrunch reported that there were 3 Million plain text passwords and email addresses leaked from a spam campaign. The email addresses and passwords were used in a targeted spamming campaign where credentials were stolen from users on Intelimost.com. These credentials were used to create convincing spam emails where prior email conversations of the user were replied to by the spammer. These emails contained links to fake but legitimate looking sites and they were injected into the email reply. The spam campaign was so effective in tricking users that it had over 100,000 click throughs. The spammers eventually abandoned the server used for conducting the campaign but left the server unsecured, leaving the passwords and email addresses used in the campaign on the server unencrypted and in plain text format.

Breach Disclosure: EverybodyEdits

In March, EverybodyEdits published a breach disclosure that exposed 871,000 user records by accidentally exporting user information to a CSV file, which was then accessed by attackers. These records contained email addresses, passwords, IP addresses and registration dates. The passwords were fully hashed and encrypted, and no plaintext passwords were leaked.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Notification of this breach was made public on April 3, 2019. EverybodyEdits disclosed that a file containing 871,000 addresses, passwords, email addresses and dates joined had been leaked and accessed by attackers. While the passwords were encrypted, attackers can use the leaked email address to search prior password leaks in an attempt to gain access to an individual’s EverybodyEdits account. Any sites that share the same password with EverybodyEdits should be updated to a unique password per site as soon as possible. In addition to the leak, the attackers also gained access to an internal database, which linked real names to Facebook accounts, along with the IP address used to access the service. A motivated attacker can use this information to discover the real names of Facebook users and potentially geolocate the user by their IP address.

Breach Disclosure: Demon Forums

DemonForums is a cybercriminal hacking forum that has existed since November 2015. The forum describes itself as “..a community forum that suits everyone. Based on general, gaming and computing discussions. Also providing leaks, resources, tools, software, tutorials and much more”. Several reports claim it was hacked on or around November 2016, where a snapshot of its source code and database contents was shared on a partner website. The leak itself contains 52,000 rows of usernames, email addresses and salted md5 passwords.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The original post for the leak occurred on LeakForums, and subsequent posts were made on competing forums, such as RaidForums. Most of these posts for the leak contained a singular SQL file with database contents from Demon Forums. Some posts, however, contained a zip file with the source code enclosed inside. The database itself also contained the salts used per hash per user, so cracking the passwords is a much easier endeavour given that they are using md5, a weak cryptographic hashing algorithm.