bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Security hole in SugarCRM servers actively exploited

Summary

In early 2023 attackers exploited a critical hole in SugarCRM (CVE-2023-22952) to take over servers and install malware. Authentication could be bypassed via the path /index.php/, after which a POST request uploaded a PNG file containing PHP code that was executed when called up later. By 11 January Censys found 354 compromised servers, just under twelve percent of all 3,059 reachable instances.

Ideas

  • Exploit code was circulating publicly even before the hotfix.
  • An image file with embedded PHP code served as a backdoor.
  • Only installations with the Sugaridentity identity management were not affected.
  • Cloud instances operated by SugarCRM were patched immediately.

Insights

  • Self-hosted business software is only as secure as its operators’ patching speed.
  • After a patch, you also have to check whether a break-in has already happened.

Facts

  • SugarCRM published an advisory and hotfix on 5 January 2023.
  • Most compromised servers were in the USA, Germany, Australia and France.

References

Critique

  • The report refers to Censys’ indicators of compromise but does not list them itself.

Recommendations

  • After critical holes, check your own servers against published indicators of compromise.
  • In web applications, prevent scripts from being executed in upload and cache directories.

Read the original article

Search the Web Archive

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2020

The tricks with the Google security hole

In early 2020 Trend Micro found malicious apps in the Google Play Store that exploited an Android hole previously used by customers of the spyware maker NSO. Google itself had discovered the hole around a year and a half earlier. The apps Camero and Filecrypt Manager served as droppers and secretly installed the spy app Callcam.