Orangetw

ModSecurity is a web application firewall engine for Apache, IIS, and Nginx. An attacker can override the HTTP response’s Content-Type, potentially leading to issues such as cross-site scripting (XSS) and arbitrary script source code disclosure.

An OS command injection flaw exists in the PHP CGI module on Windows when used with Apache. The issue arises because the Windows implementation of PHP does not account for "Best-Fit" behavior, where Unicode characters are converted to the closest matching ANSI characters. A remote attacker can send specially crafted HTTP requests containing specific character sequences that the `php-cgi` module misinterprets as PHP options. This allows the attacker to pass arbitrary options to the PHP binary, potentially leading to the disclosure of script source code or remote code execution (RCE) on the server. Real-world exploitation has been widespread, with reports of attacks targeting organizations in Japan, the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, and Malaysia. Incidents include the breach of a Japanese hosting provider affecting approximately 26,000 servers and the compromise of 25 US government-affiliated servers. Attackers have used this flaw to deploy Quasar RAT, XMRig cryptocurrency miners, and Cobalt Strike TaoWu plugins, often following up with kernel-level exploits to escalate privileges from `www-data` to root.

An issue exists in Microsoft Exchange Server related to code generation management errors. This flaw allows a remote attacker to execute arbitrary code and impact the system. In real-world incidents, this was part of a campaign targeting the Omani government, where attackers used ProxyShell exploits to compromise mail servers and gain persistent access via custom web shells to exfiltrate sensitive data from multiple ministries.

An elevation of privilege issue exists in Microsoft Exchange Server. This flaw allows an attacker to increase their privilege level on the system. Additionally, improper authentication in PowerShell may lead to remote code execution, which allows an attacker to execute arbitrary commands on the server from a remote location.

An issue was discovered that could allow an unauthenticated user to gain access to the device due to a NAS Admin authentication bypass. This could potentially lead to unauthorized access.

An issue was discovered in the rack-protection/lib/rack/protection/path traversal.rb file. Path traversal is possible via backslash characters.