CVE-2019-1903
published 2019-06-20CVE-2019-1903: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS)…
PriorityP351critical9.1CVSS 3.0
AVNACLPRNUINSUCHINAH
EPSS
2.17%
80.1th percentile
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_security_manager | >= unspecified < 4.14(0.131) | 4.14(0.131) |
| cisco | security_manager | — | — |
| cisco | security_manager_xml_entity_expansion | — | — |
| citrix | storefront | — | — |
CVSS provenance
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Citrix
CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
vendor_citrix·2019-08-29·CVSS 7.5
CVE-2019-13608 [HIGH] CWE-611 CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CISA KEV: Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Required Action: Apply updates per vendor instructions.
Known ransomware campaign use.
Cisco
Cisco Security Manager XML Entity Expansion Vulnerability
vendor_cisco·2019-06-19·CVSS 6.5
CVE-2019-1903 [MEDIUM] CWE-611 Cisco Security Manager XML Entity Expansion Vulnerability
Cisco Security Manager XML Entity Expansion Vulnerability
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition.
The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/secu
Cisco
Cisco Security Manager XML Entity Expansion Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1903 Cisco Security Manager XML Entity Expansion Vulnerability
CVE-2019-1903: Cisco Security Manager XML Entity Expansion Vulnerability
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition. There are no
CVSS: 3.0
CWE: CWE-611, CWE-611
Bug IDs: CSCvp33120
Citrix
CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
vendor_citrix·CVSS 7.5
CVE-2019-13608 [HIGH] CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
of Problem An XML External Entity (XXE) processing vulnerability has been identified in Citrix StoreFront Server that could allow an unauthenticated attacker to retrieve potentially sensitive information from the server. This vulnerability has been assigned the following CVE number: • CVE-2019-13608: XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server. This vulnerability affects the following Citrix StoreFront Server versions: • Citrix StoreFront Server earlier than 1903 • Citrix StoreFront Server 7.15 LTSR earlier than CU4 (3.12.4000) • Citrix StoreFront Server 7.6 LTSR earlier than CU8 (3.0.8000)
CVE References: CVE-2019-13608
Affected Products: Citrix StoreFront,
GHSA
GHSA-gm7g-6h7x-rpgr: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service
ghsa_unreviewed·2022-05-24
CVE-2019-1903 [CRITICAL] CWE-611 GHSA-gm7g-6h7x-rpgr: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
No detection rules found.
Exploit-DB
Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
exploitdb·2021-11-23·CVSS 7.8
CVE-2019-13272 [HIGH] Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
---
# Exploit Title: Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
# Date: 11/22/21
# Exploit Author: Ujas Dhami
# Version: 4.19 - 5.2.1
# Platform: Linux
# Tested on:
# ~ Ubuntu 19.04 kernel 5.0.0-15-generic
# ~ Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64
# ~ Kali Linux kernel 4.19.0-kali5-amd64
# CVE: CVE-2019-13272
// ....
// Original discovery and exploit author: Jann Horn
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
// Modified exploit code of: BColes
// https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272
// ....
// ~ Uses the PolKit_Exec frontend.
// ~ PolKit_Action is branched.
// ~ Search is optimized.
// ~ Trunks attain search prior
Exploit-DB
Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
exploitdb·2019-11-25·CVSS 7.8
CVE-2019-1385 [HIGH] Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
---
# Exploit Title: Microsoft Windows AppXsvc Deployment Extension - Privilege Escalation
# Date: 2019-11-22
# Exploit Author: Abdelhamid Naceri
# Vendor Homepage: www.microsoft.com
# Tested on: Windows 10 1903
# CVE : CVE-2019-1385
Windows: "AppX Deployment Service" (AppXSVC) elevation of privilege vulnerability
Class: Local Elevation of Privileges
Description:
This Poc is exploiting a vulnerability in (AppXSvc) , abusing this vulnerability
could allow an attacker to overwrite\create file as SYSTEM which can result in EOP .
The're is 2 way to abuse the issue .
Step To Reproduce :
[1] For An Arbitrary File Creation
1-Turn %userprofile%\AppData\Local\Microsoft\WindowsApps\Backup Into a Junction To
your target direc
Exploit-DB
Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation
exploitdb·2019-11-14·CVSS 7.8
CVE-2019-1405 [HIGH] Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation
Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation
---
## EDB Note
Download:
- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47684-1.exe
- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47684-2.zip
# COMahawk
**Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322**
## Video Demo
https://vimeo.com/373051209
## Usage
### Compile or Download from Release (https://github.com/apt69/COMahawk/releases)
1. Run COMahawk.exe
2. ???
3. Hopefully profit
or
1. COMahawk.exe "custom command to run" (ie. COMahawk.exe "net user /add test123 lol123 &")
2. ???
3. Hopefully profit
## Concerns
**MSDN mentioned that only 1803 to 1903 is vulnerable to CVE-2019-1322. If it doesn't work, maybe i
Exploit-DB
Microsoft Windows 10 - SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
exploitdb·2019-08-26
CVE-2019-1170 Microsoft Windows 10 - SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
Microsoft Windows 10 - SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
---
Windows: SET_REPARSE_POINT_EX Mount Point Security Feature Bypass
Platform: Windows 10 1903, 1809 (not tested earlier)
Class: Security Feature Bypass
Summary:
The NTFS driver supports a new FS control code to set a mount point which the existing sandbox mitigation doesn’t support allowing a sandboxed application to set an arbitrary mount point symbolic link.
Description:
After multiple previous attempts the kernel mitigation against adding arbitrary NTFS mount points seems pretty robust. However due to the way it was implemented inside the IO manager in the kernel it is fragile to changes inside the filesystem drivers as the mitigation is only implemented when the FSCTL_SET_REPASE_POINT control code i
Exploit-DB
Microsoft Windows 10 1903/1809 - RPCSS Activation Kernel Security Callback Privilege Escalation
exploitdb·2019-07-18
CVE-2019-1089 Microsoft Windows 10 1903/1809 - RPCSS Activation Kernel Security Callback Privilege Escalation
Microsoft Windows 10 1903/1809 - RPCSS Activation Kernel Security Callback Privilege Escalation
---
Windows: RPCSS Activation Kernel Security Callback EoP
Platform: Windows 10 1903/1809 (not tested earlier)
Class: Elevation of Privilege
Security Boundary (per Windows Security Service Criteria): User boundary
Summary:
The RPCSS Activation Kernel RPC server’s security callback can be bypassed resulting in EoP.
Description:
The RPCSS service is split into two components, RPCSS which runs as a low-privileged service account and the DCOM launch service which runs as SYSTEM and is responsible for creating new COM processes. Communication between the two services is over an RPC service named Activation Kernel (actkernel). When RPCSS receives a DCOM activation request it will pass that reque
Nuclei
Citrix StoreFront Server - XML External Entity
nuclei·CVSS 7.5
CVE-2019-13608 [HIGH] Citrix StoreFront Server - XML External Entity
Citrix StoreFront Server - XML External Entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Template:
id: CVE-2019-13608
info:
name: Citrix StoreFront Server - XML External Entity
author: daffainfo
severity: high
description: |
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
impact: |
Attackers can read arbitrary files, perform server-side request forgery, or cause denial of service through XXE attacks.
remediation: |
Update to version 1903 or later for StoreFront, CU4 or later for 7.15 LTSR, CU8 or later for 7.6 LTSR.
reference:
- https://www.exploit-db.com/exploits/47561
- https://support.citrix.com/support-home/kbsearch/arti
Unit42
Threat Brief: Microsoft DNS Server Wormable Vulnerability CVE-2020-1350
blogs_unit42·2020-07-21·CVSS 10.0
CVE-2020-1350 [CRITICAL] Threat Brief: Microsoft DNS Server Wormable Vulnerability CVE-2020-1350
## Executive Summary
In July 2020, Microsoft released a security update, CVE-2020-1350 | Windows DNS Server Remote Code Execution Vulnerability, for a new remote code execution (RCE) vulnerability.
This vulnerability exists within the Microsoft Windows Domain Name System (DNS) Server due to the improper handling of certain types of requests, specifically over port 53/TCP. Exploitation of this vulnerability is possible by creating an integer overflow, potentially leading to remote code execution.
This vulnerability only affects Windows DNS and the following builds of the Microsoft Windows operating system (OS):
- Windows Server 2008/2008 R2
- Windows Server 2012/2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server version 1803/1903/1909/2004 (Server Core installation)
#
Bugzilla
CVE-2019-17040 rsyslog: out-of-bounds read in contrib/pmdb2diag/pmdb2diag.c
bugzilla·2019-10-29·CVSS 9.8
CVE-2019-17040 [CRITICAL] CVE-2019-17040 rsyslog: out-of-bounds read in contrib/pmdb2diag/pmdb2diag.c
CVE-2019-17040 rsyslog: out-of-bounds read in contrib/pmdb2diag/pmdb2diag.c
contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.
Reference:
https://github.com/rsyslog/rsyslog/pull/3875
Discussion:
Created rsyslog tracking bugs for this issue:
Affects: fedora-all [bug 1766642]
---
Upstream commit: https://github.com/rsyslog/rsyslog/pull/3875/commits/b0894088b680666035a3418326e13bc99d4fed49
---
This flaw affects the pmdb2diag.c code file which was introduced in rsyslog-8.1903.0 which was released on 2019-03-05. Older versions of rsyslog are not affected by this flaw.
Bugzilla
CVE-2019-13272 kernel: broken permission and object lifetime handling for PTRACE_TRACEME
bugzilla·2019-07-17·CVSS 7.8
CVE-2019-13272 [HIGH] CVE-2019-13272 kernel: broken permission and object lifetime handling for PTRACE_TRACEME
CVE-2019-13272 kernel: broken permission and object lifetime handling for PTRACE_TRACEME
A flaw in the kernels implementation of ptrace which could inadvertantly grant elevated permissions to an attacker who could abuse the relationship between tracer and the process being traced.
The mechanism used to link the process requesting the ptrace and the process being ptraced could allow a local user to obtain root level priviledges by creating an opportunity to abuse the frequently used pattern of dropping privileges and then execve a child with reduced privileges/permissions.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6994e
2019-06-20
Published