Security Vulnerabilities, MS Exchange, CVE's, Bugs, Codevigilant and more

So I did the inevitable, I missed creating a weekly newsletter. Honestly, I was in the middle of so many things half done that I prioritized finishing those tasks before coming to the newsletter as I didn’t want to post a newsletter without full commitment just for the sake of it.

It seems 2021 is running on steroid with new bugs and vulnerabilities, Things just won’t stop. I made a diagram of all things got vulnerable since 1st January 2021 till now.

Desktop software to servers to WAF to Routers every single entry in this diagram has had a vulnerability disclosed or exploited. Let me recap the security vulnerabilities / disclosures that have surfaced in last 2 weeks:

This is one vulnerability which needs a dedicated space of its own. So in brief, Orange Tsai as usual came up with a brilliant research: this time with all fancy names and branding as well. The vulnerability is effectively a SSRF bug in the MS Exchange interface. Important thing to note in the link below is the timeline where Microsoft was aware of the bug since December 2020.

Microsoft released a patch to protect against this vulnerability, however reports started surfacing about active exploitation and then Microsoft also made a public blog post about nation state actors exploiting this flow.

Microsoft released a nmap NSE script, however keep in mind this open issue talking about inconsistent results from it. Various detailed writeups about the vulnerability are now public along with tools. I am listing them below, hoping it will be useful for people.

All I can say now:

While world was busy trying to fix what’s broken. I was feverishly working on the next steps for some of my own projects.

My Blogs: I have been blogging since 2007. However, I could never maintain consistent blogging. All this while I kept blaming it on my tooling, and hence I did what I should do. To prove to myself that tooling was the issue, I ran an experiment for few months running a Hugo based blog. Experiment failed miserably, and I realized fault was not in the tooling but in my motivation.

This year I am trying to revive my old projects, while continue working on newer stuff. Part of that effort was the revival of CodeVigilant. Took the first step by porting the website over to Hugo. (yup neither leaving hugo nor wordpress)

Lets not forget my other public project HackingArchivesOfIndia. So hacking archives of India were in a frozen state for past2-3 months. I have slowly added more conference data to it. This week I have added ~20 more entries.

This brings us to the last part, as a usual list of topics that could not be covered in this newspaper.

Well, this brings us to the end of this newsletter. If the content has helped you and you feel generous, donate here. If you like what you read, please subscribe to the newsletter.