Elastic Security Labs discusses detection and mitigation strategies for vulnerabilities in the CUPS printing system, which allow unauthenticated attackers to exploit the system via IPP and mDNS, resulting in remote code execution (RCE) on UNIX-based systems such as Linux, macOS, BSDs, ChromeOS, and Solaris.

Update October 2, 2024

Key takeaways

The CUPS RCE at a glance

Elastic’s POC analysis

Executing the ‘Cupshax’ POC

Assessing impact

Remediations

Elastic protections

cupsd or foomatic-rip shell execution

Printer user (lp) shell execution

Network connection by CUPS foomatic-rip child

File creation by CUPS foomatic-rip child

Suspicious execution from foomatic-rip or cupsd parent

Elastic’s Attack Discovery

Conclusion

Key References

Cups Overflow: When your printer spills more than Ink

This article introduces a previously-unnamed class of Windows vulnerability that demonstrates the dangers of assumption and describes some unintended security consequences.

Introduction

Windows file sharing

Sharing enforcement

Authenticode

Code integrity

Incorrect assumptions

Page hashes

Attacking code integrity

Paging exploitation

New research

Planning the attack

Implementation and considerations

Exploit demo

Understanding these vulnerabilities

Affected Operations

What else could be vulnerable?

Don’t forget about user mode

MapViewOfFile

ReadFile

LoadLibrary

Stopping the exploit

End-user detection and mitigation

Disclosure

Fixing Code Integrity

Summary and conclusion

Introducing a New Vulnerability Class: False File Immutability

Elastic Security Labs is releasing an initial analysis of the XZ Utility backdoor, including YARA rules, osquery, and KQL searches to identify potential compromises.

Key Takeaways

The XZ / liblzma backdoor at a glance

Backdoor analysis

XZ backdoor build process:

Assessing impact:

Malware protection

Behavior Detection

Linux: the final frontier

500ms to midnight: XZ / liblzma backdoor

Elastic is deploying a new malware signature to identify the use of the Follina vulnerability. Learn more in this post.

Summary

References

Vulnerability summary: Follina, CVE-2022-30190

In this post, we cover next steps the Elastic Security team is taking for users to continue to protect themselves against CVE-2021-44228, or Log4Shell.

Elastic Security response

A new contender: CVE-2021-45046

Thank you (again!), from Elastic Security

Analysis of Log4Shell vulnerability & CVE-2021-45046

KNOTWEED deploys the Subzero spyware through the use of 0-day exploits for Adobe Reader and the Windows operating system. Once initial access is gained, it uses different sections of Subzero to maintain persistence and perform actions on the host.

Assessment

Risk

Impact

Countermeasures

Terminology

KNOTWEED Assessment Summary

This blog post provides a summary of CVE-2021-44228 and provides Elastic Security users with detections to find active exploitation of the vulnerability in their environment. Further updates will be provided to this post as we learn more.

Overview

Summary of CVE-2021-44228 (Log4Shell)

Detecting Exploitation of Log4Shell in Elastic Security

Update: Detection & hunting improvements

Elastic Endgame EQL Queries

Community Detections

Additional Mitigation Strategies

Thank you, from Elastic Security.

Reference Material

Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security

The SIGRed vulnerability impacts all systems leveraging the Windows DNS server service (Windows 2003+). To defend your environment, we recommend implementing the detection logic included in this blog post using technology like Elastic Security.

Executive summary

Timeline of events

Tactics

Techniques

Detection

Detection logic

Unusual child of dns.exe - Kibana Query Language (KQL)

Unusual file operations of dns.exe (KQL)

Network (Packetbeat and Filebeat with the Zeek or Suricata modules)

Defensive recommendations

Detection rules for SIGRed vulnerability

Provide executive-level details about CVE-2022-22965, a recently-disclosed remote code execution (RCE) vulnerability also known as “Spring4Shell”.

What is the threat?

What is the impact?

Leveraging Elastic for exploit detection

Artifacts

Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

Vulnerability updates

类别

漏洞更新

2024年9月28日

杯满则溢：当您的打印机溢出的不仅仅是墨水

引入新的漏洞类别：虚假文件不可变性

午夜前的 500 毫秒：XZ / liblzma 后门

漏洞摘要：Follina，CVE-2022-30190

Log4Shell 漏洞和 CVE-2021-45046 分析

KNOTWEED 评估摘要

使用 Elastic Security 检测 CVE-2021-44228 (Log4j2) 的利用

SIGRed 漏洞的检测规则

Elastic 对 Spring4Shell 漏洞 (CVE-2022-22965) 的响应