ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Apr 22, 2024 · ZeroDay Catalog

    Critical Vulnerability in CrushFTP Allows Remote Code Execution

    A severe vulnerability in CrushFTP enables unauthenticated attackers to escape the VFS Sandbox, potentially leading to unauthorized access and remote code execution.

    What changed

    A significant server-side template injection vulnerability has been identified in CrushFTP, affecting all versions prior to 10.7.1 and 11.1.0. This flaw allows attackers to escape the VFS Sandbox, leading to serious security implications.

    Exploiting this vulnerability can enable unauthenticated remote attackers to access files outside the designated sandbox, bypass authentication mechanisms, and execute arbitrary code on the server.

    Who is affected

    The vulnerability impacts all users of CrushFTP, particularly those running versions before the specified updates. Organizations utilizing this software should be aware of the risks associated with this flaw.

    Given the nature of the vulnerability, any entity relying on CrushFTP for file management and transfer may be at risk of unauthorized access and potential data breaches.

    • CrushFTP users on versions prior to 10.7.1 and 11.1.0
    • Organizations managing sensitive data with CrushFTP
    • IT departments responsible for server security and maintenance

    What to do

    It is crucial for affected users to update their CrushFTP installations to the latest versions immediately to mitigate the risk posed by this vulnerability. Regularly reviewing and applying security patches will help maintain system integrity.

    Additionally, organizations should conduct a thorough security assessment to identify any potential exploitation of this vulnerability and implement monitoring to detect unauthorized access attempts.

    • Upgrade to CrushFTP version 10.7.1 or 11.1.0 or later
    • Perform security assessments to identify potential breaches
    • Implement monitoring for unauthorized access attempts

    Original report

  2. Apr 3, 2024 · ZeroDay Catalog

    Critical Command Injection Vulnerability in D-Link NAS Devices

    A critical command injection vulnerability has been identified in several D-Link NAS devices, affecting unsupported models and allowing for remote exploitation.

    What changed

    A critical command injection vulnerability has been discovered in multiple D-Link NAS devices, specifically in the HTTP GET Request Handler of the file /cgi-bin/nas_sharing.cgi. This vulnerability allows attackers to manipulate the 'system' argument, potentially leading to unauthorized command execution.

    The vulnerability has been publicly disclosed, increasing the risk of exploitation by malicious actors.

    Who is affected

    The following D-Link NAS devices are affected by this vulnerability:

    1. D-Link DNS-320L 2. D-Link DNS-325 3. D-Link DNS-327L 4. D-Link DNS-340L

    • D-Link DNS-320L
    • D-Link DNS-325
    • D-Link DNS-327L
    • D-Link DNS-340L

    What to do

    Given that the affected devices are no longer supported by D-Link, immediate remediation options are limited. Users of these devices should consider the following actions:

    1. Isolate affected devices from the network to prevent unauthorized access. 2. Evaluate the need for replacement with supported models that receive regular security updates. 3. Monitor network traffic for any suspicious activity related to these devices.

    Original report