Critical Gitlab Patch, Jenkins Janky Plugins, Microsoft Backdoor, and more.

Infosec Overnights - Daily Security News

A daily look at the relevant information security news from overnight - 01 July, 2022
Episode 256 - 01 June 2022
Critical Gitlab Patch- https://portswigger.net/daily-swig/gitlab-patches-critical-rce-bug-in-latest-security-release
Jenkins Janky Plugins -
https://www.bleepingcomputer.com/news/security/jenkins-discloses-dozens-of-zero-day-bugs-in-multiple-plugins/
WAP Fraud- https://www.zdnet.com/article/microsoft-this-android-malware-will-switch-off-your-wi-fi-empty-your-wallet/
Macmillan Incident -
https://www.securityweek.com/brocade-vulnerabilities-could-impact-storage-solutions-several-major-companies
Microsoft Backdoor -
https://thehackernews.com/2022/07/new-sessionmanager-backdoor-targeting.html
Dangling Chromium -
https://portswigger.net/daily-swig/chromium-browsers-vulnerable-to-dangling-markup-injection
Hi, I’m Paul Torgersen. It’s Friday July 1st 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
Gitlab has patched a vulnerability that could allow remote code execution. The critical severity flaw affects all versions of GitLab. A fix has been released for this and a number of other vulnerabilities, including two separate cross-site scripting bugs. Link to the Gitlab advisory in the article.
From BleepingComputer.com:
Jenkins announced 34 security vulnerabilities affecting 29 plugins for the Jenkins open source automation server, 29 of the bugs being zero-days still waiting to be patched. Jenkins supports over 1,700 plugins, with those affected by this disclosure having more than 22,000 installs. Fortunately none of these are rated critical as there are no fixes as of yet for most of them. See the list of affected plugins in the article.
From ZDNet.com:
Microsoft shared its detailed technical analysis of what it says is one of the most prevalent types of Android malware. It’s called 'toll billing', or Wireless Application Protocol fraud. This involves using an infected device to connect to payment pages of a premium service via a device's WAP connection. From there, payments are automatically charged to a device's phone bill. Details and a link to the analysis in the article.
From BleepingComputer.com
Publishing giant Macmillan was forced to shut down their network and offices while recovering from a security incident. In emails to customers, Macmillan stated the incident involves the encryption of certain files on their network, so this is almost certainly a ransomware attack. No word on the threat actor as Macmillian has slowly started to bring systems back online.
And last today, from TheHackerNews.com
A newly discovered malware called SessionManager, has backdoored Microsoft Exchange servers since at least March of 2021. If you recall, that was right after the ProxyLogon flaw was discovered. The malware masquerades as a module for Internet Information Services, with capabilities to read, write, and delete arbitrary files; execute binaries from the server; and establish communications with other endpoints in the network.
That’s all for me this week. Have a great Fourth of July long weekend, and until next time, be safe out there.