Censys Rapid Response

The Censys ARC team is tracking the PHP2Shell vulnerability in real time. Live updates on global PHP2Shell exposure are available on the PHP2Shell dashboard.Additional context and queries for affected assets are available in the Censys ARC Rapid Response advisory.

A total of 14 vulnerabilities affecting DrayTek Vigor routers were disclosed yesterday in a report by Forescout. The vulnerabilities were scored as follows: 2 critical severity, 9 high severity, and 3 medium severity. Most of these vulnerabilities are found in DrayTek VigorConnect, the web control interface for Vigor routers.Let’s examine the most severe vulnerability, CVE-2024-41592, which has been assigned the maximum CVSS score of 10.0. It’s a buffer overflow in the GetCGI() function of the VigorConnect Web UI that can be triggered by sending a specially crafted, excessively long query string to any of the CGI pages.When exploited individually, CVE-2024-41592 allows a threat actor to potentially cause a Denial of Service. However, if chained with CVE-2024-41585—the second-most severe vulnerability, which is an OS command injection flaw—it is possible to gain remote root access to the host operating system. This exploit chain only affects Vigor router models 3910 and 3912.If a router

BackgroundYesterday, September 26, after significant anticipation and dramatic drum rolling on social media, a series of vulnerabilities were disclosed in the Common Unix Printing Service (CUPS), a widely used printing utility found on many Linux distributions (specifically these ones, according to the original researcher’s writeup). These vulnerabilities are summarized below: Source: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/#SummaryThe most buzzy of these vulnerabilities is CVE-2024-47176, which affects cups-browsed. After a Red Hat security forum discussion, this was initially unofficially associated with a CVSS score of 9.9, but GitHub recently assigned it a score of 8.3 (High).Understanding CUPS and IPPCUPS is found on many Linux and other Unix systems for managing printing jobs and queues. It is used in conjunction with the Internet Printing Protocol (IPP) for network communication between computers and printers. IPP was designed to allow device

Date of Disclosure: September 19, 2024CVE-ID and CVSS Score: CVE-2024-8963 is a critical vulnerability with a CVSS score of 9.4.Issue Name and Description: Ivanti Cloud Services Appliance (CSA) If successfully exploited it allows a remote unauthenticated attacker to achieve restricted access. As noted in Ivanti’s security advisory, if chained with CVE-2024-8190 (OS command injection) an attacker can gain admin privileges and achieve RCE. Censys PerspectiveAt the time of writing, Censys observes 2,017 exposed Ivanti CSA instances online, mostly concentrated in the U.S. Note that not all of these are necessarily vulnerable – as specific device versions are not available. This vulnerability affects CSA versions 4.6.0 and earlier.To identify potentially exposed Ivanti Cloud Services Appliance instances, the following Censys queries can be used:Censys Search Query: services.http.response.html_title=`Ivanti(R) Cloud Services Appliance` Censys ASM Query: host.services.http.response.html_title

We recently dug into the DigiCert Domain Control Verification compliance issue to try and quantify its real-world impact and determine how many public-facing web entities are using an affected certificate. As of two days ago over 26,000 certificates are still active on public websites across ~3.5 million physical and virtual hosts -- although almost 99% of those certs have already been revoked. We also analyzed registered domains to identify the most impacted companies and industries. You can read more about our findings in our blog published yesterday: The DigiCert DCV Bug: Implications and Industry Impact. Organizations have until this Friday at 20:30 UTC to replace these certificates according to DigiCert.If you're looking to find affected certificates, you can use this Censys Search query: labels=digicert-revoked-dcv  and filter on your domains (by appending and services.tls.certificates.leaf_data.names=*.yourdomain.com). Keep in mind that results will continue to roll in over the

 This week the Censys Rapid Response team published an advisory on the recently disclosed Exim vulnerability tracked as CVE-2024-39929.In Exim versions through 4.97.1, a bug in the parsing of multiline RFC 2231-encoded headers leads to incomplete parsing of attachment filenames. Remote actors could exploit this to bypass malicious file extension blocking measures and potentially send malicious attachments such as .exe executables undetected to users' email inboxes.This bug is concerning due to how widespread Exim is on public-facing mail servers. Censys identifies around 1.5 million Exim servers online that are potentially vulnerable to this exploit.However, exploiting this vulnerability alone is unlikely to fully compromise a server. Users need to actively click and execute attachments to trigger any embedded malicious code.Check out the post for more information. The team has provided the following Censys queries to track affected devices:Censys Search Query for Potentially Vulnerabl

The Censys rapid response team has released its rapid response advisory on the recently disclosed RCE vulnerability in OpenSSH. Check out the post for full information on exploitation details and potential impact. The team has provided the following queries to use related to this vuln: Censys ASM Risk query: risks.name=”Vulnerable OpenSSH [CVE-2024-6387]” If you have any questions about this vuln or have suggestions for detecting with Censys, leave them here!