This Week in Security: Dating App, WooCommerce, and OpenSSH
Unsecured Database Exposes Dating App Users
A report from vpnMentor revealed an unsecured database backing several dating apps, including 419 Dating. The exposed database contained 2.3 million records, including email addresses, photos, and more. The issue was promptly disclosed and secured, but the app has been removed from the Google Play store.
WooCommerce Vulnerability Exploited
WooCommerce plugin for WordPress had a security flaw (CVE-2023-28121) fixed in March, but working exploits have surfaced. The vulnerability allowed an unauthenticated user to take control of other user accounts. On July 16, Wordfence observed a staggering 1.3 million exploitation attempts, raising concerns for WordPress sites using WooCommerce.
OpenSSH Remote Code Execution Vulnerability
A remote code execution (RCE) vulnerability bypassing security measures was discovered in OpenSSH. The flaw can be triggered by exploiting ssh-agent forwarding. Researchers at Qualsys identified the issue and created a fix. Users are advised to avoid ssh-agent forwarding and consider alternative methods.
Forager: Search Engine for Leaked Secrets
Truffle Security introduced Forager, an automated search engine for leaked secrets on GitHub. The tool confirms legitimate secrets, notifies organizations of leaks, and categorizes the results. Truffle Security sees around 1,800 new secrets leaked daily on GitHub.
Bits and Bytes
- Cyberark provides a guide to MacOS pen testing, focusing on sandboxing, GUI, and network testing.
- Eclypsium discovers critical vulnerabilities in Gigabyte's Baseboard Management Controller firmware, leading to a worst-case CVSS 10 attack scenario.
