Threat briefs

This brief details the detection of local account creation on macOS systems, a technique often used by adversaries to establish persistence or facilitate privilege escalation through administrative utilities.

This brief details a detection strategy for identifying unauthorized outbound network connections initiated by native Windows Living Off the Land Binaries and Scripts (LOLBAS) often used for C2 and payload delivery.

An analytic identification of Living Off the Land Binaries and Scripts (LOLBAS) initiating public network connections over non-standard destination ports, indicating potential staging or command-and-control activity.

Attackers are exploiting vulnerabilities in the Ghostscript library, such as CVE-2024-29510, to achieve remote code execution through malicious file processing.

Detection engineers can identify potential data destruction attempts on Linux hosts by monitoring for the use of the 'rm' command with the '--no-preserve-root' flag, a technique utilized by the Awfulshred malware.

Adversaries leverage native utilities like icacls.exe to modify file and directory permissions via deny flags, effectively hindering security operations and maintaining persistence.

A detection rule identifies potentially compromised accounts by aggregating multiple high-risk security alerts associated with the same user ID within a four-hour window.

A vulnerability in the IBM i DDM target dispatcher allows remote attackers to manipulate database transactions due to improper authorization handling.

IBM ContextForge MCP Gateway is susceptible to server-side request forgery (SSRF) via DNS rebinding, allowing a remote authenticated attacker to access sensitive internal network information.

IBM Instana Agent Operator versions 1.0.303 through 1.0.323 contain a vulnerability involving missing namespace validation that allows an authenticated attacker to copy sensitive etcd mTLS credentials to an attacker-controlled namespace.

IBM ContextForge MCP Gateway versions 1.0.6 and earlier contain a DNS rebinding vulnerability that allows remote authenticated attackers to access sensitive information during tool invocation.

Trigger.dev versions prior to 4.5.2 contain an improper authorization vulnerability that allows authenticated attackers to inject task runs into arbitrary environments.

An authenticated tenant can perform privilege escalation in Kubernetes clusters using IBM Instana Agent Operator (Build 1.0.303 through 1.0.323) by creating a malicious Custom Resource that overwrites shared cluster-level RBAC objects.

The excel-mcp-server package version 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to perform arbitrary file reads and writes on the host system.

North Korean state-sponsored actors are deploying a sophisticated Linux backdoor named 'ted' by replacing legitimate HAProxy binaries with trojanized versions to intercept web traffic and execute malicious commands.

Jina AI reader is vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation during HTTP redirects, allowing access to internal network or cloud metadata services.

LaVague version 0.2.35 contains a remote code execution vulnerability in the PythonFromMarkdownExtractor.extract_as_object function, allowing attackers to execute arbitrary code via indirect prompt injection.

MegaParse version 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint, allowing attackers to access internal resources and cloud metadata.

Plandex version 2.2.1 contains a path traversal vulnerability in the ApplyFiles function allowing arbitrary file writes via manipulated model outputs, potentially leading to remote code execution.

The surya screenshot server version 0.22.1 is vulnerable to an unauthenticated arbitrary file read vulnerability via the /info, /page, and /process routes, allowing attackers to access sensitive local files.

An unauthenticated server-side request forgery (SSRF) vulnerability in ms-swift version 4.5.2 allows attackers to perform unauthorized requests to internal network services and cloud metadata endpoints.

The OWL DocumentProcessingToolkit is vulnerable to server-side request forgery in the extract_document_content tool, allowing attackers to perform prompt injection to exfiltrate internal resources.

The aider CLI tool is vulnerable to arbitrary command execution because it automatically executes shell commands defined in a .aider.conf.yml file located in the root of a Git repository upon startup.

LLaMA-Factory is vulnerable to server-side request forgery (SSRF) due to improper validation of multimodal media URLs in its OpenAI-compatible API, allowing unauthenticated attackers to access internal network resources.

QAnything 2.0.0 contains an authentication bypass vulnerability in multiple API endpoints that allows unauthenticated attackers to exfiltrate sensitive uploaded documents and knowledge base files.

Xinference versions 3.x and commit 4a94832 contain an unauthenticated arbitrary file read vulnerability via the model_path parameter in the auto-register endpoint.

OGX contains an unauthenticated Server-Side Request Forgery vulnerability in the POST /v1/responses endpoint, allowing remote attackers to probe internal cloud metadata services.

The cli-mcp-server package version 0.2.5 contains a vulnerability in the _validate_command_with_operators function allowing attackers to bypass command allowlists via shell substitution.

git-mcp-server version 2.15.1 is vulnerable to argument injection due to insufficient input validation in the ref and object parameters of its git tools, allowing for arbitrary file writes.

The sift.js library version 17.1.3 is vulnerable to arbitrary code execution when processing untrusted input that leverages prototype pollution or malicious $where operator strings to invoke the new Function constructor.