ManageEngine auth bypass hands attackers the keys to your vault

Attackers can hit the Hongjing e-HR getSdutyTree endpoint without authenticating (they bypass the auth filter with a path traversal trick) and inject SQL into the codeitemid parameter. That lets them dump the entire database, including user credentials, from the underlying MSSQL server. Shadowserver observed exploitation in the wild starting July 30, 2024.

Affected estate

Anyone running Hongjing e-HR with the getSdutyTree servlet exposed

How to check

Check whether the /getSdutyTree path is reachable from the internet. Review web server access logs for requests containing path traversal sequences targeting that endpoint.

Included because

unauthenticated; internet-facing; exploited in the wild (Shadowserver); credential exposure; CVSS 7.5

Action

Patch to the latest Hongjing e-HR release. If no fix is available, block access to the getSdutyTree endpoint externally and audit your MSSQL database for signs of credential exfiltration.

Why it matters

This is unauthenticated SQL injection with confirmed exploitation. Attackers can dump credentials and sensitive HR data.

Source

Shadowserver Foundation

A KVM bug on s390 (IBM Z) lets a guest VM register PCI interrupts without a summary bit, causing the host kernel to store a bogus physical address derived from NULL. This can corrupt host memory or crash the hypervisor. Exploitation requires a malicious or compromised guest running on s390 KVM, so this only matters if you run KVM on IBM Z hardware.

Affected estate

Linux KVM operators running s390x (IBM Z) hosts with PCI passthrough to guests

How to check

Run 'uname -m' to confirm s390x architecture, then check if KVM PCI passthrough is configured for any guest VMs. Review your kernel version against the patch commit.

Included because

hypervisor escape potential; CVSS 8.8; requires s390x with PCI passthrough (limited audience)

Action

Update the host kernel to the patched version from your distro's s390x channel.

Why it matters

A malicious guest could crash or corrupt the hypervisor host, affecting all VMs on that machine.

Source

Linux kernel mailing list

When IBM i Access Client Solutions is installed for all users on Windows, it uses a directory that any local user can write to. An attacker with local access can drop a malicious binary into that directory and get it executed with elevated privileges. This requires local access to the machine, so it's a privilege escalation vector, not a remote attack.

Affected estate

Windows admins with IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 installed in all-users mode

How to check

Check the installed version via Add/Remove Programs or the ACS About dialog. Verify whether the installation directory grants write access to non-admin users with 'icacls' on the install path.

Included because

local privilege escalation; common enterprise tool; CVSS 7.3; requires local access

Action

Upgrade to IBM i Access Client Solutions 1.1.9.14+. Lock down directory permissions on the install path.

Why it matters

Any local user on the machine can escalate to higher privileges by planting a malicious file in the writable directory.

Source

IBM security advisory

An authenticated tenant in a Multicluster Engine (MCE) environment can manipulate ClusterClaim labels to force a cluster into another tenant's ManagedClusterSet. That lets the attacker push policies and workloads onto clusters they don't own. This requires an authenticated tenant account, so it's a cross-tenant boundary violation, not an unauthenticated attack.

Affected estate

OpenShift admins running Red Hat Multicluster Engine (MCE) in multi-tenant configurations

How to check

Check your MCE version in the OpenShift console under Installed Operators. Review ClusterClaim resources for unexpected label modifications using 'oc get clusterclaims -A -o yaml'.

Included because

cross-tenant boundary bypass; authenticated required; multi-tenant Kubernetes environments; CVSS 7.1

Action

Update MCE to the patched release. Audit existing ClusterClaim labels and ManagedClusterSet bindings for unauthorized changes.

Why it matters

A rogue tenant can hijack another tenant's cluster and inject arbitrary policies and workloads into it.

Source

Red Hat advisory