Configuration-Modification - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/configuration-modification/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 29 Jan 2024 12:00:00 +0000AVideo CDN Plugin Unauthenticated Configuration Modificationhttps://feed.craftedsignal.io/briefs/2024-01-avideo-cdn-config-vuln/Mon, 29 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-avideo-cdn-config-vuln/AVideo is vulnerable to unauthenticated configuration modification in its CDN plugin due to a bypassed key validation check when the default empty key is used, allowing modification of CDN URLs, storage credentials, and the authentication key itself.AVideo, an open source video platform, contains a critical vulnerability (CVE-2026-33719) within its CDN plugin. Versions up to and including 26.0 are affected. The vulnerability stems from the endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php using key-based authentication with an empty string as the default key. Critically, when the CDN plugin is enabled but the key remains at its default (empty) state, the authentication check is bypassed entirely. This allows any unauthenticated attacker to fully modify the CDN configuration through mass-assignment via the par request parameter. This includes the ability to manipulate CDN URLs, storage credentials, and even the authentication key itself. A patch has been released in commit adeff0a31ba04a56f411eef256139fd7ed7d4310. This is significant because it can lead to complete compromise of the video delivery infrastructure.

Attack Chain

  1. An attacker identifies an AVideo instance with the CDN plugin enabled.
  2. The attacker checks the CDN configuration by sending a GET request to plugin/CDN/status.json.php without any authentication headers to confirm if CDN plugin is enabled and running with default configuration.
  3. If the CDN key is the default empty string, the attacker crafts a malicious POST request to plugin/CDN/status.json.php or plugin/CDN/disable.json.php.
  4. The POST request includes the par parameter containing a JSON object with modified CDN settings, such as CDN URLs and storage credentials.
  5. Due to the bypassed authentication, the AVideo server processes the request and updates the CDN configuration.
  6. The attacker can modify the CDN URL to point to a malicious server hosting malware or phishing content.
  7. Legitimate users requesting video content are redirected to the attacker's malicious CDN.
  8. The attacker can also steal storage credentials and compromise the CDN's data.

Impact

Successful exploitation of CVE-2026-33719 allows an unauthenticated attacker to take complete control over the video delivery infrastructure. This can result in serving malicious content to users, data exfiltration from the CDN storage, or complete disruption of video services. The number of victims depends on the popularity of the affected AVideo instances. This vulnerability impacts any organization using AVideo with the CDN plugin enabled and the default configuration, including educational institutions, media companies, and content creators.

Recommendation

  • Apply the patch from commit adeff0a31ba04a56f411eef256139fd7ed7d4310 or upgrade to a version of AVideo that includes this fix to remediate CVE-2026-33719.
  • Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the plugin/CDN/status.json.php and plugin/CDN/disable.json.php endpoints.
  • Monitor web server logs for POST requests to plugin/CDN/status.json.php or plugin/CDN/disable.json.php endpoints without proper authentication headers, as these may indicate an attempted exploit.
  • As a temporary workaround, configure a strong, non-default key for the CDN plugin to prevent the authentication bypass.
]]>highadvisoryavideocdnconfiguration-modificationvulnerabilityUnusual Modification of GenAI Tool Configuration Filehttps://feed.craftedsignal.io/briefs/2024-01-genai-config-modify/Wed, 03 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-genai-config-modify/This rule detects unusual modifications to GenAI tool configuration files, potentially indicating an attacker injecting malicious MCP server configurations to hijack AI agents for persistence, command and control, or data exfiltration.This detection identifies suspicious modifications to configuration files associated with Generative AI (GenAI) tools such as Cursor, Claude, Copilot, and Ollama. Attackers may attempt to inject malicious Model Context Protocol (MCP) server configurations into these files. This allows them to hijack AI agents for various malicious purposes, including persistence, establishing command and control (C2) channels, or exfiltrating sensitive data. The attack vectors can include direct modification via malware or compromised scripts, supply chain attacks through tainted dependencies, and prompt injection attacks where the GenAI tool is manipulated into altering its own settings. Successful modification allows unauthorized MCP servers to execute arbitrary commands upon subsequent invocations of the affected AI tool. The timeframe for detection looks back 9 months.

Attack Chain

  1. Initial Compromise: An attacker gains initial access via malware, compromised scripts, or supply chain vulnerabilities targeting GenAI development environments.
  2. Configuration Discovery: The attacker identifies the location of GenAI tool configuration files, such as .cursor/mcp.json, .claude/, or .config/github-copilot/.
  3. Malicious Modification: The attacker modifies the configuration file, injecting a malicious MCP server URL or unauthorized plugin configurations. This could be achieved through direct file modification using scripting tools, or via prompt injection techniques.
  4. Persistence via MCP: The attacker leverages the injected malicious MCP server for persistence. The GenAI tool will load the attacker's server on next invocation.
  5. Command and Control: The injected MCP server establishes a command and control (C2) channel, allowing the attacker to remotely control the compromised AI agent.
  6. Data Exfiltration or Code Execution: Once the MCP server is running, the attacker executes arbitrary commands or exfiltrates sensitive data via the compromised AI agent. This data can include API keys, proprietary code, or customer data accessible by the GenAI tool.
  7. Lateral Movement: The attacker uses the compromised GenAI tool as a pivot point to move laterally within the network, accessing other sensitive systems or data.

Impact

A successful attack can lead to the compromise of sensitive data handled by the GenAI tool, including API keys, source code, and user data. The attacker could also use the compromised AI agent for persistence, allowing them to maintain a foothold within the targeted environment. Successful exploitation could lead to significant data breaches, intellectual property theft, and reputational damage. The rule's description mentions the Cybereason blog on weaponized AI and MCPs, noting it being used for account takeover.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect unusual processes modifying GenAI configuration files based on the file paths specified in the file.path field of the rule.
  • Investigate any alerts generated by the Sigma rule by examining the modifying process's origin, parent process tree, and network connections.
  • Monitor file integrity using tools like Sysmon or auditd on the GenAI configuration file paths to detect unauthorized modifications.
  • Implement network-level blocking for any unauthorized MCP server URLs discovered in compromised configuration files.
  • Rotate any potentially exposed API keys or credentials that may have been compromised through the GenAI configuration files.
]]>mediumadvisorygenaiconfiguration-modificationdefense-evasion