1010.cx

  • HashiCorp Vault Vulnerability Let Attackers to Crash Servers

    ·

    , , ,

    A critical denial-of-service vulnerability in HashiCorp Vault could allow malicious actors to overwhelm servers with specially crafted JSON payloads, leading to excessive resource consumption and rendering Vault instances unresponsive. 

    Tracked as CVE-2025-6203 and published on August 28, 2025, the flaw affects both Vault Community and Enterprise editions from version 1.15.0 up to several patched releases. 

    Operators are urged to upgrade to Vault 1.20.3 (Community and Enterprise), 1.19.9, 1.18.14, or 1.16.25 to mitigate the issue.

    Memory-Based DoS Vulnerability

    Vault’s audit devices are responsible for logging every request interaction before completing the request. 

    A malicious user can submit a payload that meets the default max_request_size limit (32 MiB by default) but leverages deeply nested JSON structures or excessive entries to force extreme CPU and memory usage in the audit subroutine. 

    As the JSON parser recurses through long string values or high object entry counts, memory consumption spikes, triggering timeouts and causing the Vault server to become unresponsive.

    HashiCorp has introduced new listener configuration options to further harden Vault against abusive JSON payloads. The TCP listener may now be configured with:

    • max_json_depth: Maximum nesting depth for JSON objects.
    • max_json_string_value_length: Maximum length for string values.
    • max_json_object_entry_count: Maximum number of key/value pairs in an object.
    • max_json_array_element_count: Maximum elements in a JSON array.

    Operators can find detailed guidance in the API documentation for listener parameters and the Vault upgrade guide.

    HashiCorp acknowledges Darrell Bethea, Ph.D., of Indeed for responsibly reporting this vulnerability.

    Risk FactorsDetails
    Affected ProductsVault Community and Vault Enterprise 1.15.0 through 1.20.2, 1.19.8, 1.18.13, and 1.16.24
    ImpactDenial of Service
    Exploit PrerequisitesNetwork access to Vault listener; ability to submit HTTP API requests with crafted JSON payloads
    CVSS 3.1 Score7.5 (High)

    Mitigations

    To remediate CVE-2025-6203, customers should upgrade to one of the patched versions: Vault Community Edition 1.20.3 or Vault Enterprise editions 1.20.3, 1.19.9, 1.18.14, or 1.16.25. 

    Upgrading will enable built-in limits on JSON payload complexity, preventing the excessive recursion that triggers the Denial of Service. 

    Administrators are also encouraged to review their max_request_size settings and apply listener-level constraints to JSON parsing as part of a defense-in-depth strategy.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post HashiCorp Vault Vulnerability Let Attackers to Crash Servers appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MobSF Security Testing Tool Vulnerability Let Attackers Upload Malicious Files

    ·

    , , ,

    A critical flaw in the Mobile Security Framework (MobSF) has been discovered, allowing authenticated attackers to upload and execute malicious files by exploiting improper path validation. 

    The vulnerability, present in version 4.4.0 and patched in 4.4.1, underscores the importance of rigorous sanitization when handling user‐supplied file paths and archives.

    Key Takeaways
    1. MobSF v4.4.0 allowed attackers to exploit file path flaws to access sensitive files.
    2. These vulnerabilities risked data leaks and system corruption.
    3. Update and secure the platform.

    Directory Traversal Vulnerability (CVE-2025-58161)

    The first issue resides in the download handler implemented in MobSF/views/home.py. The function naively strips the /download/ prefix and concatenates the remaining string to the configured settings.DWD_DIR using Python’s Path API:

    MobSF Security Testing Tool Vulnerability

    Here, is_safe_path() uses os.path.commonprefix() to verify that the resolved check_path begins with the safe_root. 

    However, since commonprefix compares raw strings, a sibling directory named /home/mobsf/.MobSF/downloads_bak is incorrectly considered inside /home/mobsf/.MobSF/downloads. By issuing a request like:

    MobSF Security Testing Tool Vulnerability

    An attacker can retrieve any file with an allowed extension from the sibling directory. 

    This Directory Traversal vulnerability (CVE-2025-58161) carries a Low severity rating (CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N) and affects all installations using version 4.4.0 of the mobsf package.

    Absolute Path Slip Vulnerability

    A second, more severe weakness (CVE-2025-58162) affects the AR archive extraction logic in mobsf/StaticAnalyzer/views/common/shared_func.py. 

    The ar_extract() function decodes each archive member name and filters only for relative‐path traversals (.., %2e%2e, etc.), neglecting absolute filenames:

    MobSF Security Testing Tool Vulnerability

    When filtered begins with /, Path(dst) / filtered resolves to the absolute path. An attacker-controlled .a archive containing a member like /home/mobsf/.MobSF/db.sqlite3 results in overwriting the database file outside the intended static_objects directory. 

    Demonstrations showed that uploading a crafted archive triggers a server error and corrupts the SQLite database, leading to malfunctioning scans and potential Stored XSS by tampering with static templates.

    This Moderate severity flaw (CVSS 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) enables arbitrary file writes under the MobSF process’s privileges, risking distortion of analysis results, integrity compromise, and service disruption.

    CVE IDTitleCVSS 3.1 ScoreSeverity
    CVE-2025-58161Path Traversal in MobSF Download Route0Low
    CVE-2025-58162Arbitrary File Write via .a Archive Extraction7.4Moderate

    Mitigation 

    Credit for discovering these vulnerabilities goes to Vasily Leshchenko (Solar AppSec) and the reporter noname1337h1. 

    Both issues have been addressed in MobSF 4.4.1. Users should upgrade immediately. Recommended fixes include:

    • Rejecting absolute paths by normalizing input with os.path.isabs() checks.
    • Using os.path.commonpath() instead of commonprefix() for robust directory boundary enforcement.
    • Ensuring archive extraction always verifies that normalized target paths remain under the intended root.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post MobSF Security Testing Tool Vulnerability Let Attackers Upload Malicious Files appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MobSF Vulnerability Allows Attackers to Upload Malicious Files

    ·

    , , ,

    Critical security flaws discovered in Mobile Security Framework (MobSF) version 4.4.0 enable authenticated attackers to exploit path traversal and arbitrary file write vulnerabilities, potentially compromising system integrity and exposing sensitive data. Two significant vulnerabilities have been identified in the popular Mobile Security Framework (MobSF), a widely-used open-source mobile application security testing platform. The flaws, tracked […]

    The post MobSF Vulnerability Allows Attackers to Upload Malicious Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware

    ·

    The threat actor known as Silver Fox has been attributed to abuse of a previously unknown vulnerable driver associated with WatchDog Anti-malware as part of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disarming security solutions installed on compromised hosts. The vulnerable driver in question is “amsdk.sys” (version 1.0.600), a 64-bit, validly signed Windows kernel device driver

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New TinkyWinkey Stealthily Attacking Windows Systems With Advanced Keylogging Capabilities

    ·

    , ,

    A sophisticated Windows-based keylogger known as TinkyWinkey began surfacing on underground forums in late June 2025, targeting enterprise and individual endpoints with unprecedented stealth.

    Unlike traditional keylogging tools that rely on simple hooks or user-mode processes, TinkyWinkey leverages dual components—a Windows service and an injected DLL payload—to remain hidden while harvesting rich contextual data.

    The malware’s emergence underscores a troubling evolution in threat actor tactics, blending deep system profiling with low-level keyboard capture to deliver a highly attractive target for espionage and credential theft.

    TinkyWinkey’s attack vector typically begins with the installation of a malicious service named “Tinky.” Installed via SCM API calls, the service is configured for automatic startup, ensuring persistence even across system reboots.

    Upon activation, the service worker thread spawns the primary keylogging module (winkey.exe) within the active user session by invoking CreateProcessAsUser on a duplicated user token.

    Keylogging Storage (Source – Cyfirma)

    This approach not only avoids visible console windows but also gains direct access to user-mode desktop contexts. Cyfirma analysts noted that this technique allows the malware to run seamlessly under standard user privileges while maintaining stealth within system processes.

    Once loaded, the keylogger component employs low-level hooks (WH_KEYBOARD_LL) to intercept every keystroke, including media keys, modifier combinations, and Unicode characters.

    The malware maintains a continuous message loop to dispatch captured events, correlating each keystroke with the foreground window title and the current keyboard layout.

    Cyfirma researchers identified that TinkyWinkey dynamically detects layout changes through HKL handles, logging events whenever the victim switches between languages.

    This ensures that attackers can accurately reconstruct multilingual inputs, a feature often overlooked by simpler keyloggers.

    TinkyWinkey is a Windows-based project (Source – Cyfirma)
    typedef LONG (WINAPI *RtlGetVersionPtr)(PRTL_OSVERSIONINFOW);
void log_windows_version() {
    HMODULE hMod = LoadLibraryW(L"ntdll.dll");
    if (hMod) {
        RtlGetVersionPtr fn = (RtlGetVersionPtr)GetProcAddress(hMod, "RtlGetVersion");
        RTL_OSVERSIONINFOW rovi = { sizeof(rovi) };
        if (fn(&rovi) == 0) {
            char buffer[128];
            snprintf(buffer, sizeof(buffer),
                     "Windows version: %ld.%ld (build %ld)\n",
                     rovi.dwMajorVersion, rovi.dwMinorVersion, rovi.dwBuildNumber);
            write_to_file(buffer);
        }
    }
}

    Infection Mechanism and Persistence Tactics

    TinkyWinkey’s infection mechanism hinges on its service-based persistence and stealthy DLL injection. After establishing the “Tinky” service, the loader resolves the PID of a trusted process—most commonly explorer.exe—using a custom FindTargetPID routine.

    Upon obtaining a handle with PROCESS_ALL_ACCESS, it allocates memory in the target process via VirtualAllocEx and writes the full path to keylogger.dll.

    A subsequent CreateRemoteThread call, pointing at LoadLibraryW, forces the trusted process to load the malicious DLL.

    Malicious Windows service named ‘Tinky’ (Source – Cyfirma)

    This remote injection method not only conceals the keylogging code within a legitimate process but also evades many endpoint protection solutions that monitor standalone executables.

    A final WaitForSingleObject call ensures the injection completes cleanly before handles are closed, preserving system stability and further masking the compromise from forensic analysis.

    Through its combined service execution and precise DLL injection, TinkyWinkey achieves a level of stealth and resilience rarely seen in commodity malware, rendering traditional detection and removal strategies insufficient for defending modern Windows environments.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New TinkyWinkey Stealthily Attacking Windows Systems With Advanced Keylogging Capabilities appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Space Force goes commercial for space domain awareness

    ·

    The Space Force has been working closely with private investment firms to get a leg up on emerging technologies. The result is a “pool” of companies with products the service wants, a senior defense official says.

    “Another innovation influence for us, which is new, is the introduction of the acquisition for the Space Force to the venture capital community and the investment community—not a community we interacted with in the past. And so this is a whole new community that we've been engaging with, learning with, going to their activities and understanding what their thinking is. In turn, we talk about what we're looking for in space companies,” said Maj. Gen. Stephen Purdy, who is the military deputy, acting assistant secretary of the Air Force and service acquisition executive for space, during the National Defense Industrial Association’s emerging technology conference on Thursday. 

    The U.S. Space Force has, through SpaceWERX, spent recent years working with the private investment community to foster relationships with newer companies and keep up with the rapid development of commercial space technology. 

    “We have been forming, over the last year, a pool of companies in space that have got a real product,” he said.

    As a result, the service has re-evaluated more traditional acquisition programs. 

    “We've gone and looked at many of our acquisition programs that were on the more traditional route, and said, ‘Is there anything that we can do on the requirements side that's causing us not to go to commercial? Can we take advantage of this? In several, we found good avenues to propose to the Space Force requirements community,” Purdy said. “And some of those decided to take us up on our offer.” 

    That was the case with the Space Force’s Geosynchronous Space Situational Awareness Program, or GSSAP, for space domain awareness.

    “It started early this year [with] nothing in mind, and…We had an industry day, and it grew up to like 150 companies that are expressing interest in this activity. We had a gold mine of interest in this area,” Purdy said. “That shows you how vibrant that innovation market is for space.” 

    The Space Force has been pushing for more adoption of lower-cost commercial options for certain military missions. The service wants multiple companies to provide services rather than relying on a “one and done” approach, Purdy continued. 

    “We will fly multiple companies’ material. That's going to keep all those different lines and all those different companies active and hungry to go for that next tranche,” he said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • HashiCorp Vault Vulnerability Allows Attackers to Crash Servers

    ·

    , , ,

    A critical vulnerability in HashiCorp Vault—tracked as CVE-2025-6203 and HCSEC-2025-24—has been disclosed that allows malicious actors to submit specially crafted payloads capable of exhausting server resources and rendering Vault instances unresponsive. The flaw affects both Vault Community and Enterprise editions, spanning versions 1.15.0 through 1.20.2 (with select earlier patch versions), and was publicly disclosed on […]

    The post HashiCorp Vault Vulnerability Allows Attackers to Crash Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Azure AD Vulnerability Leaks Credentials, Lets Attackers Deploy Malicious Apps

    ·

    , ,

    Exposing an ASP.NET Core appsettings.json file containing Azure Active Directory (Azure AD) credentials poses a critical attack vector, effectively handing adversaries the keys to an organization’s cloud environment. During a recent cybersecurity assessment by Resecurity’s HUNTER Team, researchers discovered that a publicly accessible appsettings.json file had exposed the ClientId and ClientSecret of an Azure AD application, […]

    The post Azure AD Vulnerability Leaks Credentials, Lets Attackers Deploy Malicious Apps appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer

    ·

    , , ,

    In a novel twist on the year-long trend of ClickFix scams, threat actors have blended human-verification social engineering with the Windows search protocol to deliver MetaStealer, a commodity infostealer notorious for harvesting credentials and exfiltrating sensitive files. While the attack superficially resembles classic ClickFix and FileFix techniques, its unique infection chain—from a fake AnyDesk installer […]

    The post Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Qualcomm Vulnerabilities Allow Attackers to Execute Arbitrary Code Remotely

    ·

    , , ,

    Multiple critical vulnerabilities in Qualcomm Technologies’ proprietary Data Network Stack and Multi-Mode Call Processor that permit remote attackers to execute arbitrary code. 

    These flaws, tracked as CVE-2025-21483 and CVE-2025-27034, each carry a CVSS score of 9.8 and exploit buffer-corruption weaknesses to compromise device security.

    Key Takeaways
    1. CVE-2025-21483 & CVE-2025-27034 allow remote RCE.
    2. Affects Snapdragon 8 Gen1/Gen2, FastConnect, X55, IoT/automotive chips.
    3. Patch now and filter RTP/PLMN traffic.

    CVE-2025-21483: Remote Heap Buffer Overflow 

    The most severe issue, CVE-2025-21483, resides in Qualcomm’s Real-time Transport Protocol (RTP) packet reassembly within the Data Network Stack & Connectivity module. 

    An attacker can send a malicious RTP packet that triggers a heap-based buffer overflow (CWE-119) by overrunning the NALU reassembly buffer. 

    With a remote access vector and no user interaction required, this vulnerability enables full control over affected chipsets, including Snapdragon 8 Gen1, Snapdragon 8 Gen2, FastConnect 7800, and dozens more. 

    Once exploited, arbitrary code execution at the kernel level can occur, compromising data confidentiality, integrity, and availability.

    CVE-2025-27034: Improper Array Index Validation Flaw

    Equally critical is CVE-2025-27034, which stems from an improper validation of an array index (CWE-129) in the Multi-Mode Call Processor. 

    Attackers can craft a malformed Public Land Mobile Network (PLMN) selection response that corrupts memory during index parsing. 

    The flaw’s remote access vector and lack of privilege requirements make it exploitable over the network. 

    Affected platforms include the Snapdragon X55 5G Modem-RF System, Snapdragon 8 Gen1, QCM5430, and numerous IoT and automotive modems. Successful exploitation leads to arbitrary code execution with escalated privileges.

    CVETitleCVSS 3.1 ScoreSeverity
    CVE-2025-21483Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity9.8Critical
    CVE-2025-27034Improper Validation of Array Index in Multi-Mode Call Processor9.8Critical

    Mitigations 

    Qualcomm has issued patches for both vulnerabilities, distributing updates directly to OEMs and urging immediate deployment. 

    The recommended countermeasure is to integrate the proprietary software updates provided in the September 2025 Security Bulletin and verify the presence of hardened bounds-checking routines. 

    Device manufacturers must ensure timely firmware upgrades to eliminate attack vectors in CVE-2025-21483’s RTP parser and CVE-2025-27034’s array index logic.

    Security researchers emphasize the necessity of monitoring CVSS strings and employing network filtering as an interim safeguard. 

    Administrators should block unexpected RTP streams and PLMN selection traffic until patched firmware is installed. Additionally, implementing strict SELinux policies on Android platforms can further constrain exploit attempts.

    Stakeholders are advised to audit firmware versions, apply patches immediately, and maintain vigilant network monitoring to defend against these high-severity exploits.

    Qualcomm customers and device end-users should contact their manufacturers or visit Qualcomm’s support portal for detailed patch instructions and chipset coverage details.

    Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

    The post Critical Qualcomm Vulnerabilities Allow Attackers to Execute Arbitrary Code Remotely appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶