Researchers found several points of entry for potential attackers, one of which was Apple’s Book Travel portal, where they took advantage of a significant SQL injection vulnerability.
Experimenting with the Masa/Mura CMS revealed the attack surface, primarily the one available within Apple’s environment.
The JSON API was the main focus because it provides access to certain functions available within Apple’s environment. A JSON API should be the source of any potentially susceptible sink researchers discover.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
In a blog post in ProjectDiscovery Cloud Platform, researchers explain how they focused SQL injection sink detection.
A critical condition in the dspObjects function was found by researchers. An if condition needs to be met before invoking getObjects: the Mura servlet event handler’s isOnDisplay property needs to be set to true.
At first, researchers thought that any property on the event handler could be set by just providing the property name and value as parameters. Their debugging session inside the codebase served as the foundation for this hypothesis.
The previewID property can be set to any value by supplying it as an argument, and this will cause the isOnDisplay property to be set to true.
“Since this was an error-based SQL injection, we could exploit it quite easily to achieve Remote Code Execution (RCE). Locally, we successfully performed RCE”, researchers said.
Researchers used these procedures to successfully conduct RCE:
The researchers duly shared the findings with Apple and the corresponding Masa and Mura CMS teams.
Apple promptly addressed the stated issue by responding and implementing a fix within two hours of the initial report.
Masa is an open-source fork of Mura CMS; they released a fixed version of Masa CMS with great transparency.
The most recent security fixes, which address another critical pre-auth SQL injection and have been assigned CVE (CVE-2024-32640), are included in the 7.4.6, 7.3.13, and 7.2.8 versions.
After many attempts to contact the Mura team about these vulnerabilities via various communication methods, no response was received.
Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide
The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations, particularly…
As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search Service…
UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider, has…
Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800 compromised…
Cybersecurity researchers have uncovered a critical flaw in the content moderation systems of AI models…
Microsoft’s cybersecurity research team has issued a stark warning about the risks of using default…