securityaffairs.com Open in urlscan Pro
2606:4700:3031::6815:90b  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * CISA adds ZK Java Web Framework bug to Known Exploited Vulnerabilities
   Catalog
 * Resecurity identified the investment scam network 'Digital Smoke'
 * LastPass: hackers breached the computer of a DevOps engineer in a second
   attack
 * Threat actors leak Activision employee data on hacking forum
 * PlugX Trojan disguised as a legitimate Windows open-source tool in recent
   attacks
 * Dutch Police arrests 3 men involved in a massive extortion scheme. One of
   them is an ethical hacker



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


CISA ADDS ZK JAVA WEB FRAMEWORK BUG TO KNOWN EXPLOITED VULNERABILITIES CATALOG

February 28, 2023  By Pierluigi Paganini




US CISA ADDED AN ACTIVELY EXPLOITED VULNERABILITY IN THE ZK JAVA WEB FRAMEWORK
TO ITS KNOWN EXPLOITED VULNERABILITIES CATALOG.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a
vulnerability, tracked as CVE-2022-36537 (CVSS score: 7.5), in the ZK Java Web
open-source framework to its Known Exploited Vulnerabilities Catalog. An
attacker can exploit the flaw to retrieve sensitive information through
specially crafted POST requests sent to the component AuUploader.

“ZK Framework AuUploader servlets contain an unspecified vulnerability that
could allow an attacker to retrieve the content of a file located in the web
context. The ZK Framework is an open-source Java framework.” reads the advisory.

The vulnerability affects ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3,
9.0.1.2, and 8.6.4.1.

This flaw impacts multiple products, including but not limited to ConnectWise
R1Soft Server Backup Manager.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant
Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the
identified vulnerabilities by the due date to protect their networks against
attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the
vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this flaw by March 20, 2023.

The vulnerability was reported by Markus Wulftange of Code White GmbH, it was
addressed by the vendor in May 2022 with the release of versions 9.6.2, 9.6.0.2,
9.5.1.4, 9.0.1.3, and 8.6.4.2.

In October 2022, researchers from Huntress published a proof-of-concept (PoC)
exploit code

As demonstrated by Huntress in a proof-of-concept (PoC) in October 2022.

The following video demonstrates the POC exploit being used to these
aforementioned steps: 1) bypass authentication, 2) upload a backdoored JDBC
database driver to gain code execution, and 3) use the REST API to trigger
commands to registered agents to ultimately push the recently leaked Lockbit 3.0
ransomware to all downstream endpoints.



Researchers from Fox-IT recently reported the active exploitation of the flaw to
deploy a backdoor.

“During a recent incident response case, we found traces of an adversary
leveraging ConnectWise R1Soft Server Backup Manager software (hereinafter:
R1Soft server software). The adversary used it as an initial point of
access and as a platform to control downstream systems connected via the R1Soft
Backup Agent. This agent is installed on systems to support being backed up by
the R1Soft server software and typically runs with high privileges. This means
that after the adversary initially gained access via the R1Soft server software
it was able to execute commands on all systems running the agent connected to
this R1Soft server.” reads the post published by Fox-IT. “The adversary
exploited the R1Soft server software via CVE-2022-36537 [1] [2], which is a
vulnerability in the ZK Java Framework that R1Soft Server Backup Manager
utilises.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ZK Java Web Framework)


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


CISAHackinghacking newsinformation security newsIT Information SecurityPierluigi
PaganiniSecurity AffairsSecurity NewsZK Java Web Framework


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Resecurity identified the investment scam network 'Digital Smoke'


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


RESECURITY IDENTIFIED THE INVESTMENT SCAM NETWORK ‘DIGITAL SMOKE’

February 28, 2023  By Pierluigi Paganini

LASTPASS: HACKERS BREACHED THE COMPUTER OF A DEVOPS ENGINEER IN A SECOND ATTACK

February 27, 2023  By Pierluigi Paganini






 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER
   
   


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

RESECURITY IDENTIFIED THE INVESTMENT SCAM NETWORK 'DIGITAL SMOKE'

Resecurity identified one of the largest investment fraud networks, tracked as
Digital Smoke, by size and volume of operations. Resecurity...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version