tag: Public-Poc · 4 items
- Engineer — Act: Public PoC is live and attackers are already exploiting this critical SharePoint flaw — patch SharePoint on-prem deployments immediately and audit SharePoint ULS and IIS logs for anomalous authentication or anonymous access patterns from the PoC release date forward.
- SOC/IR — Act: Active in-the-wild exploitation means an immediate hunt is warranted — query SIEM for unusual SharePoint authentication events, abnormal REST/SOAP API calls, or unexpected file-access patterns since Rapid7’s PoC publication date, and tune alerts on SharePoint edge access.
- Leader — Plan: A critical SharePoint vulnerability with a public PoC and confirmed exploitation warrants confirming on-prem SharePoint exposure with your engineering team and ensuring an emergency patch window is scheduled this week if not already done.
- Engineer — Act: A public PoC now exists for a domain-hijack flaw in AD Certificate Services; audit your PKI templates for misconfigured enrollment permissions and apply any available patch or Microsoft-recommended mitigation immediately.
- SOC/IR — Plan: Build detections for anomalous certificate enrollment requests and CA template abuse (e.g., unusual Enrollee Supplies Subject flag usage); no confirmed active exploitation reported yet, but PoC availability shortens the runway.
- Leader — Learn: A PoC for a Windows domain-compromise vulnerability is now public; no board-level action needed yet, but monitor for escalation to active exploitation that could affect enterprise AD environments.
- Engineer — Act: A working public exploit now exists for this six-week-old GitLab flaw; any authenticated user with push access on an unpatched self-managed instance can achieve RCE. Upgrade to the patched version released June 10 immediately and verify no self-managed GitLab instances remain on 18.11.3.
- SOC/IR — Act: PoC publication on July 24 makes exploitation imminent; hunt for anomalous Jupyter notebook pushes followed by commit-diff access on self-managed GitLab instances, and look for unexpected git-process child execution in EDR telemetry as of that date.
- Leader — Plan: A public exploit for GitLab RCE elevates CI/CD pipeline compromise risk this week; confirm with engineering that all self-managed GitLab instances are on the June 10 patched release before this becomes an active incident requiring notification.
- Engineer — Act: A public Docker lab with a working one-payload exploit now exists for fastjson 1.2.66–1.2.83; critically, autoType=OFF and parseObject binding are not effective mitigations. Audit your dependency tree for fastjson in this range and upgrade to 1.2.84+ (or fastjson2), treating autoType-disabled deployments as unprotected.
- SOC/IR — Plan: The public exploit lab lowers the bar for threat actors to weaponize this Spring Boot class-loading RCE chain. Build or tune detections for unexpected outbound SSRF from Java application hosts followed by remote class loading activity; the SSRF→defineClass pattern is a distinct behavioral signal to hunt for in proxy and EDR telemetry.
- Leader — Skip