Week of September 9, 2024

A deserialization vulnerability in Ivanti Endpoint Manager's AgentPortal service allows unauthenticated remote code execution. The flaw resides in the .NET remoting service handling the IAgentPortal interface, specifically the RunProgram action. Ivanti patched the issue by restricting executable paths and enforcing firewall checks.

Stroz Friedberg observed ransomware actors using a technique called 'Retrosigned Driver EDR Bypass' to load malicious kernel drivers signed with expired certificates by manipulating system time. This allows attackers to terminate EDR processes and limit telemetry visibility. The technique was seen in Medusa and Abysslocker ransomware incidents.

Fortinet disclosed a data breach where an attacker accessed a limited number of files on a third-party cloud-based shared file drive, impacting less than 0.3% of customers. The hacker, 'Fortibitch', leaked 440 GB of data after a ransom demand was refused. Fortinet states operations, products, and services were unaffected, and no malicious customer activity has been observed.

CVE-2024-20430 is a local privilege escalation vulnerability in Cisco Meraki Systems Manager Agent for Windows. It allows a low-privileged authenticated attacker to execute arbitrary code with SYSTEM privileges via DLL hijacking. The vulnerability stems from uncontrolled search path elements during agent startup.

A vulnerability in the Palo Alto Networks Cortex XDR agent on Windows allows a user with local administrator privileges to disable the agent. This could enable malware to deactivate the security agent and then perform malicious actions undetected. The issue is fixed in agent version 8.2 and later.

A vulnerability in the Ivanti Endpoint Manager (EPM) agent allows a local authenticated attacker with administrator privileges to escalate to SYSTEM via an uncontrolled search path. The flaw affects EPM agent versions prior to 2022 SU6 and the 2024 September update. Successful exploitation can lead to full compromise of the endpoint.