erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: June 25, 2024

2 editorial briefs and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806). Organizations running self-hosted MOVEit Transfer 2023.0, 2023.1 or 2024.0 builds older than the fixed releases, especially with the SFTP service reachable from the internet.
  • Check exposure: polyfill.io. Site owners whose HTML, templates, themes or plugins still reference cdn.polyfill.io, polyfill.com, or the related bootcdn, bootcss and staticfile domains.
  • Composer (PHP): 1 critical advisory (craftcms/cms). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-5806

MOVEit Transfer: SFTP Authentication Bypass (CVE-2024-5806)

If you run MOVEit Transfer with SFTP exposed and are not on a fixed build, treat it as urgent: exploit details went public on disclosure day and attempts followed within hours.

Must act: Organizations running self-hosted MOVEit Transfer 2023.0, 2023.1 or 2024.0 builds older than the fixed releases, especially with the SFTP service reachable from the internet.

Can relax: Everyone not running MOVEit Transfer, MOVEit Cloud customers (patched by Progress), and admins already on 2023.0.11, 2023.1.6, 2024.0.2 or later.

  1. Upgrade MOVEit Transfer to 2023.0.11, 2023.1.6, 2024.0.2 or any later supported release
  2. Restrict SFTP (port 22) exposure to known partner IP ranges where possible
  3. Block inbound RDP to MOVEit servers and limit outbound connections to known, trusted endpoints, as Progress advised

Read the brief →

Check exposure

· Supply-chain compromise

polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites

The malicious domain has been suspended since June 27, 2024, but any page that still loads a script from polyfill.io or its sister domains is trusting an attacker-linked host and should be cleaned up.

Must act: Site owners whose HTML, templates, themes or plugins still reference cdn.polyfill.io, polyfill.com, or the related bootcdn, bootcss and staticfile domains.

Can relax: Sites that self-host their JavaScript, or that never used polyfill.io, are not affected, and modern browsers rarely need these polyfills at all.

  1. Grep source, templates and built assets for polyfill.io, polyfill.com, bootcdn, bootcss and staticfile
  2. Delete the script tags; most sites no longer need these polyfills
  3. If you must keep polyfills, self-host them or use the Cloudflare or Fastly replacements

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 1

Check: composer audit