April 2021 Summaries

The PHP packaging ecosystem is vulnerable to security threats due to its reliance on third-party software components, which can be exploited through supply chain attacks. A critical vulnerability was discovered in Composer, a widely used tool for managing and installing software dependencies, allowing arbitrary system commands to be executed on the Packagist.org server. The vulnerability was patched by the maintainers within 12 hours of discovery, but it highlights the importance of auditing tools in the supply chain and providing additional expertise on code signing and reducing the impact of such attacks. Researchers have demonstrated how a seemingly innocuous bug can have significant consequences, emphasizing the need for vigilance in identifying and addressing security issues in package managers and associated services.

The newly discovered XXE vulnerability affects WordPress versions prior to 5.7.1, allowing authenticated attackers to retrieve sensitive files on the host server, including database credentials in `wp-config.php`. The vulnerability is related to PHP 8 and requires specific permissions, making it exploitable with lower privileges than usual. The attack relies on exploiting a blind XXE technique, where an attacker injects malicious XML into WordPress's media library to extract sensitive file content from the host server. The vulnerability was fixed in WordPress version 5.7.1, which includes a patch that reintroduces the call to `libxml_disable_entity_loader()` deprecated in PHP 8. Developers can prevent similar code vulnerabilities by using `libxml_set_external_entity_loader()`, which allows more granular control over external entity loading. The incident highlights the importance of keeping software up-to-date and being cautious when handling user-controlled content in XML parsing scenarios.

The SecurityEmissary is a P2P-based data-driven workflow engine that runs on a heterogeneous and multi-tiered network, with its Java source code available on the official GitHub repository of the US National Security Agency (NSA). An analysis of version 5.9.0 revealed several code vulnerabilities that allow remote attackers to execute arbitrary system commands on any Emissary server, potentially compromising the entire P2P network. The combination of these vulnerabilities enables various attack vectors, including Code Injection, Arbitrary File Upload, Arbitrary File Disclosure, and Reflected Cross-site-Scripting. An attacker can exploit these vulnerabilities by abusing intended features of the software, such as the web application's vulnerability to Cross-Site Request Forgery (CSRF) attacks. The analysis revealed that a simple authentication mechanism is not enough to secure a web application, and that developers' intentions can sometimes create opportunities for attackers. Emissary has since released patches to address these vulnerabilities, including version 6.1, which fixes most of the issues reported in this blog post.