Got tired of the Reboot notification window from Windows 98? Need to let your users know something? Alert the logged in user about anything? Use our new Topia executables for better user experience! Available from version 4.1.5 and above. For more information regarding the custom message, please refer to https://customer-portal.vicarius.io/how-to-create-a-custom-popup-notification
#topia_updates
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About VRX VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
Arbitrary command execution has been found in JsonWebToken version 8.5.1 and lower, and registered as CVE-2022–23529
Library details
Description:
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
When a user access some page, the token will be passed to verify the method in the back-end. so what happens is that verify method takes three parameters token, secretOrPublickKey, [options, callback].
you can pass a payload to the second parameter and that payload will be executed.
The End Game
Based on what unit42 discovered and also based on my analysis it’s not easy or obvious how to achieve full RCE.
I want to show the analysis I did here, my final thoughts explaining why I don’t think RCE or I don’t see real exploitation behind it.
Maybe I’m wrong, or Maybe I’m right 😀 Who knows!
Prerequisites
Download nodejs
sudo apt install nodejs
Download npm
sudo apt install npm
Download jsonwebtoken version 8.5.1 or earlier.
npm i jsonwebtoken@8.5.1
Understanding of how jsonwebtoken works?
I won’t go into detail here, but I will explain the basics of the structure of JWT and how it works.
I will provide references so you can dive in depth with it if you like.
Basically, JWT token consists of three parts
Header: Algorithm & Token Type
Payload: Data
Verify Signature
Example:
When the user login in, the request with username and password go to Auth server, and the Auth server will verify and check the username and password based on that it will generate JWT Token for this user.
Now each time the user visits any page or route, the JWT token will be associated with the request headers.
here is where the vulnerable snippet of the code based on unit42 report.
After I tried to craft/edit/manipulate the JWT token, it didn’t really work.
in fact, it makes sense why it didn’t work because the payload supposes to go into the second parameter in the verify method where it’s marked in red, but the token is the first parameter, it’s marked in blue.
Final thoughts
To be honest, I’m not sure how this can be exploited remotely or even if you have access to the backend. However, based on what’s mentioned in “Exploitation Prerequisites” section in unit42 report it looks like there is no obvious scenario to exploit this.
Also based on the comments in the GitHub commit here it looks like a lot of people agree on that as well.
Some ideas for more in-depth research I was thinking about:
Maybe finding some misconfiguration scenario for JWT would help with exploiting this vulnerability.
I was thinking, about how those parameters get stored? for example in smart contracts variables are in memories like in slides. so you can overwrite the second variable in our case the secretOrPublicKey variable.
#jwt #cve #analysis #CVE-2022-23529
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About VRX VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
I once managed a product line when I didn’t even have access to revenue figures. Looking back now, that seems unthinkable. How was I supposed to manage a business when I didn’t even know how it was doing? I’m going to bet many others have a story like that too: where a culture of secrecy kept them from effectively doing their job.
In contrast, at runZero, we work at creating a culture of transparency: an environment where information flows between different levels of the organization and employees feel comfortable asking questions and sharing feedback.
When the executive team openly communicates with their employees, it builds trust and respect. In turn, employees are more likely to be productive and act in the best interest of the company. At tech companies, employees especially need access to accurate, up-to-date information to do their jobs well.
Ultimately, a culture of transparency leads to success because everyone is on the same page and working towards the same goals. Let’s dive into the specific values we’ve developed to promote and nurture transparency within our company.
Decentralize decision-making
Cultural value: “We provide transparency about decisions and the state of the business so everyone can make the right decisions autonomously.”
At runZero, transparency is a fundamental part of the way we do business. We focus on openness, so everyone knows the expectations, trusts each other, and feels confident in their role.
This level of transparency plays out in a variety of ways. At our monthly virtual town halls, for example, we are open about our standing as a company, where we are going, and what’s coming next. Our town halls deliver detailed information on financials, business performance, and even our cash position. We intend to be as honest if our cash position ever changes for the worse (though it hasn’t happened yet at the moment). By building trust and being transparent, everyone at runZero will feel like they are part of our successes and solutions.
When it comes to strategic planning, leaders provide context on the business to the team ahead of time, even if final decisions aren’t made yet. Leadership needs to be vulnerable in order to do this. They need to be able to admit that they don’t have all the answers yet, but are willing to share where they are in the process. This approach fosters collaboration and invites feedback. These are key elements to solving complex problems. We also take this approach in our one-on-one meetings.
We don’t pretend to have all the answers and understand that our employees may feel some degree of ambiguity in the face of such openness. This mindset allows for a free exchange of ideas between leadership and staff and promotes an environment where key players can work together to come to a consensus. The openness and directness of our leadership encourages employees to participate in the brainstorming process, ensuring that we make decisions based on collective wisdom instead of individual opinion.
When employees are confident in the knowledge they have, they can make the informed decisions independently, instead of expending time and resources asking for approvals internally. Transparency is essential for creating an environment where autonomous decision-making is not only accepted but encouraged.
The line between confidentiality and transparency
While transparency helps keep everyone in the loop, there are certain aspects of any business that must remain confidential, such as employee data and other human resources type information. In these cases, full transparency is not always the best solution.
In fact, during times of rebranding or restructuring, it’s better to wait until the new direction is clear before sharing any information widely, so it doesn’t create confusion. Information shared in confidence, for example about performance or health issues, should also not be shared widely.
However, our internal communication will always strive to be as honest and transparent as reasonably possible. We trust our employees to handle sensitive matters with utmost discretion and integrity.
Foster transparency through sharing
Cultural value: “We reward people who share information rather than hoard it.”
Information hoarding and siloed decision-making leads to inefficient processes and mistrust inside an organization.
Employees often hoard information to protect themselves from negative perceptions or to make themselves more valuable in the organization. However, when employees feel secure and comfortable in their environment, information hoarding becomes unnecessary.
That’s why we model and reward information sharing and transparency. For example, runZero’s Google Drive is fairly open—almost any employee has access to the files, except for those pertaining to sensitive information like human resources or finance. Generally speaking, however, employees can dig around for all kinds of data: company stats, dashboards, Hubspot data, and more. If employees can investigate, they can find solutions. In turn, we give them recognition for finding those solutions.
By providing tools like these and encouraging employees to use them openly and confidently, we avoid the issue of information hoarding altogether.
Help candidates grow through transparency
Cultural value: “If we turn a candidate down and we have helpful feedback, we offer to provide it.”
Sharing feedback with a candidate during the hiring process can be one of the most challenging tasks for any leader. Not only do we have to choose our words carefully, so that the message is constructive, but we also have to pick information that is truly valuable for the candidate’s growth. We also give the candidate the option to decline feedback, as we know sometimes that it can be a hard pill to swallow, depending on their circumstances.
The most difficult type of feedback is about someone’s potential. Oftentimes, this feedback may not consist of more than general comments about their capabilities or capacity for growth. It can be hard to deliver this type of feedback without it being demoralizing. So, we try to encourage candidates, while giving clear guidance on what specific improvements to help them understand what we are looking for at runZero. You never know what could happen: a few years down the line, the candidate could improve with feedback, timing shifts, and they end up being just the right fit for runZero.
We want the best fit for everyone involved. Anyone interviewing a candidate for runZero will be open and transparent, and we look for that to be reciprocated. We really listen for people with a growth mindset and who value transparency as much as we do.
Be honest with customers
Cultural value: We only take deals that are mutually beneficial partnerships. We take an honest, consultative approach to selling. We don’t pressure customers into sales if runZero is the wrong solution.
At runZero, we pride ourselves on our commitment to fair and transparent pricing. We are honest with our customers about what our product can do and if their requests exceed its capabilities, it’s best that everyone knows sooner rather than later. It saves everyone time in the long run. The sales team can disqualify the deal earlier and spend more time on deals with a higher likelihood to close. Disqualifying a deal builds trust and helps the customer understand the problems we can solve for them – and some return later when they are looking for a solution to those problems. The company experiences a higher renewal rate because customers weren’t oversold.
This approach benefits both parties in different ways: by being upfront about what our product can do, buyers benefit from a service that actually gives them what they need, while sellers don’t waste time trying to convince someone of a product that ultimately won’t work for them.
By committing to this type of customer service, we hope to help create an environment where buyers and sellers form trusting relationships.
The foundations of a great team and company
Open and honest dialogue is the cornerstone of any healthy team. Carrying out transparency in everything we do creates deeper connections between employees, leaders, and customers. We understand that fostering a supportive environment means that everyone should have access to information needed to be successful in their roles.
Creating a culture of transparency guides us at runZero every day. So if you’re looking for a role where transparency is in our DNA, we’d love for you to join us.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
When monitoring the software components of a server, sometimes you may need to find out some additional information about the performance of the metrics you monitor.
Sending additional information in email alerts
This is all about putting data into context, because 25 is not the same if it is 25% of a CPU, or 25% of a CPU with other three more CPUs, all of them at 100%, or 25% of a CPU of a computer about to be blocked by excess of I/O transactions that has been overloaded for hours, which has risen the system’s temperature to the maximum.
Isn’t it true that “25” can mean many things? Let’s dig a little deeper into it
Continuing with the previous case, suppose that you wish to measure the CPU usage in one of the servers you manage, and where you defined thresholds that force notifications by email to computer managers.
This threshold (CRIT for CPU > 80) would be reflected in the module configuration as follows:
The alert is defined using the template “Critical condition” and I use the action of sending custom email to send to a specific mailbox.
Okay, so far it’s kind of basic.
But you may like to be able to send some additional information about the problem, something to collect only when needed, real-time information that is useful for you to find a solution automatically.
But…. Can Pandora FMS do this?
Well, you may include information from other modules in the email using alert macros that reference other modules.
moduledata_X_: It will show the data of the “X” module of the same agent as that of the module that triggers the alert.
That way, if you have a module called LoadAVG, calling the macro _moduledata_LoadAVG_ you may dump the value of the system load.
Likewise, to show a graph of the last 24 hours of that module, you should use the macro _modulegraph_LoadAVG_24_
*This last thing about the graph is still experimental, until version 772 it will not be available to everyone.
Showing procedures
Perhaps you would like to include textual information about what to do in case your module is set into CRITICAL, as some kind of instructions or procedure. To that end the macro _alert_critical_instructions_ will return the text that you configured in said module for this case.
Showing previous data
You may also be interested in showing the previous data on this monitor before the alert was triggered; to that end you may use the macro _prevdata_
Showing agent informational custom fields
Imagine that you have a field in the agent that collects data, which tells you the name of the system administrator and their phone number, as custom agent fields with ID 7 and ID 9.
To that end we would use the macro_agentcustomfield_n_ as macro_agentcustomfield_7_ and macro_agentcustomfield_9_ and thus be able to add to the email the name and phone of the person in charge of the system.
A full example, using macros in an email
Let’s now see an example!
If you wanted to send a somewhat more complete email, edit the email action you are using to add new macros:
Using dynamic information
What if you want to go further?
What if you want to execute a command every time something happens and collect the value to send it in the email?
That way, you do not need to have a constant additional metric when monitoring so as not to fill the database with information that is only useful in critical situations.
In order to submit additional information, it will be necessary to create a previous module in your software agent so that it collects the information only when necessary.
With that purpose in mind, enter the following structure within your module:
module_begin
module_name MODULE_NAME
module_type async_string
module_precondition > X COMMAND_TO_RUN_AS_CONDITION
module_exec FINAL_COMMAND_TO_BE_EXECUTED
module_end
The module will have to be asynchronous and with the type of data that you will collect.
This is due to the need for this module not to go into an unknown state, thus giving a false perception of failure, when it does not meet the module’s precondition.
A condition expression will have to be incorporated so that you may run the module normally.
For that purpose, run a previous command from which to obtain the numerical information to obtain the data. Following the example of the CPU described above (which is higher than 80%) it would be something like:
Once you create the module that will only be executed when necessary, enter this information in your email.
For that purpose use the following macro within the email:
_moduledata_TOP5_CPU_Proc_Usage_ This is only a way of using it to send the additional information, you may use it for other cases such as for example if the disk usage of a server is reaching the limit, you may show the five heaviest files saved on the server using the command “du -Sah/ | sort -rh | head -5”
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.
JumpCloud delivers single sign-on (SSO) to everything, including RADIUS authentication and authorization for network devices. Multi-factor authentication (MFA) is environment wide, delivering Push MFA for RADIUS. RADIUS is a core network protocol that’s widely used for Wi-Fi authentication, and it provides authentication, authorization, and accounting (AAA).
JumpCloud Cloud RADIUS simplifies and secures privileged administrative access for network admins. It’s also an option to configure access to LANs for all of your SSL VPN users. JumpCloud eliminates the need to use Fortinet’s FortiTokens for MFA.
This two-part blog series explores two use cases with FortiGate next-generation firewall:
Option 1: Use existing local FortiGate groups that contain FortiGate remote users. This approach is ideal for existing appliances that already have settings and users.
Option 2: Use remote groups (JumpCloud) and attribute mapping to set up access control on a new Fortinet device. This approach spares admins the work of having to establish local groups using ACLs on the Fortinet appliance.
This article focuses on Option 1.
We’ll demonstrate how to bind the local user to the JumpCloud RADIUS server that is configured inside your FortiGate so that JumpCloud becomes the authentication authority without changing anything in the way the appliance is configured for network posture.
Note: It’s also possible to accomplish this using a different brand of network appliance.
Configuring JumpCloud RADIUS and Groups
Follow this guide to get started with JumpCloud groups. You may also refer back to this previous tutorial on how to configure SAML access for Fortinet devices if it better suits your requirements. However, RADIUS has the advantage of also mapping groups and authorizations/permissions.
Establishing Groups and MFA
You may have MFA required for individual users or leverage groups with conditional access. Skip this step if you’ve already configured your access control policies.
To require MFA factors for the User Portal on an individual user account:
In the User Security Settings and Permissions section, select Require Multi-Factor Authentication for User Portal option. Note: The enrollment period only affects TOTP MFA. See Considerations.
Click save user.
To require MFA factors for the User Portal on existing users from the more actions menu:
Select any users you want to require MFA for.
Click more actions, then select Require MFA on User Portal.
Specify the number of days the user has to enroll in MFA before they are required to have MFA at login. You can specify a number of days between 1 and 365. The default value is 7 days.
Click require to add this requirement to the selected users.
To require MFA factors with a Conditional Access Policy:
If you don’t want the policy to take effect right away, toggle the Policy Status to OFF and finish the rest of the configuration. When you’re ready to apply the policy, you can toggle the Policy Status to ON.
For users, choose one of the following options:
Select All Users if you want the policy to apply to all users.
Select Selected User Groups if you want the policy to apply to specific user groups, then search for those user groups and select them. If you need to create user groups, see Getting Started: Groups.
If there are User Groups you want to exclude from the policy, search for the user groups and select them in the search bar under Excluded User Groups.
Optionally, set the conditions a user needs to meet. Note: Conditions is a premium feature available in the Platform Plus plan. Learn more about conditions in Getting Started: Conditional Access Policies.
In Action, select Allow authentication into selected resources, then select the Require MFA option.
Click create policy.
Two JumpCloud groups were created for the purpose of this tutorial:
Enter a name for the server. This value is arbitrary.
Enter a public IP address from which your organization’s traffic will originate.
Provide a shared secret. This value is shared with the device or service endpoint you’re pairing with the RADIUS server.
Select an identity provider.
Now select an authentication method:
To use certificate authentication, select Passwordless.
Once Passwordless has been selected, the Save button will be disabled until a certificate has been successfully uploaded (or the authentication method has been changed back to Password).
If desired, select Allow password authentication as an alternative method.
If this checkbox is selected, admins can enable certificates for some users while allowing others to continue validating by username and password. Users will continue to have the option to validate by username and password, but once they choose to validate with certificates and a valid certificate is found, the password option will no longer be presented.
The MFA Configuration section will be available if using JumpCloud as the identity provider, and Passwordless is selected as the Authentication Method, and the Allow password authentication as an alternative method checkbox is selected.
Configuring multi-factor authentication (MFA).
Toggle the MFA Requirement option to “enabled” for this server. This option is disabled by default.
Select Require MFA on all users or Only require MFA on users enrolled in MFA.
If selecting Require MFA on all users, a sub-bullet allows for excluding users in a TOTP enrollment period, but this does not apply to JumpCloud Protect™ (users in a TOTP enrollment period who are successfully enrolled in Protect will still be required to complete MFA).
If JumpCloud Protect is not yet enabled, users can select the Enable Now link.
Uploading a Certificate Authority (CA).
To upload your certificate, click on the Choose a File button, navigate to the file location, and select it for uploading.
Once the file has uploaded successfully the file name will display on the screen and options will change to replacing or deleting the file. There is also an option to view the full CA chain.
Clicking Save will return the user to the main RADIUS screen, where the Certificate badge will display in the Primary Authentication column. Note: For more information about where and how to find trusted certificates outside of JumpCloud, see RADIUS-CBA Tools for BYO Certificates.
Select Users for Access to the RADIUS Server (User Groups tab):
To grant access to the RADIUS server, click the User Groups tab then select the appropriate groups of users you want to connect to the server.
Every user who is active in that group will be granted access.
Click save.
Note: Users who are being granted access to a RADIUS server and leveraging delegated authentication (with Azure AD as their identity provider) must be imported into JumpCloud and assigned to a User Group.
FortiGate Settings
Follow these instructions to configure the RADIUS server(s) in your FortiGate appliance. Next, we’ll make it possible for your existing users to use JumpCloud’s identity and access management (IAM).
Local Groups with Remote Users
You may enter more than one JumpCloud RADIUS server IP for redundancy. The next section uses the FortiGate command line interface (CLI) to convert your existing local users into RADIUS users. Then, you’ll match the usernames with the respective JumpCloud usernames. Significantly, there will be no changes made from an access control list (ACL) perspective. Yet, you’ll increase your network security and easily meet compliance requirements. The steps are simple, and will spare a small and medium-sized enterprise (SME) the time and expense of allocating/billing blocks of hours with a network technician or MSP partner.
Converting Local Users Into RADIUS Users
The first step is to launch your CLI to convert users that already exist in FortiGate.
An existing user and user group
This may be scripted to streamline the process for a group of users. The steps include:
# config user local (local # edit “USER NAME” # show # set type radius # set radius-server YOUR SERVER # end
Checking Your Work
You may verify these settings by entering:
# config user local (local) # edit USER NAME # show # end
The local user is looking at the remote RADIUS user for authentication
Ensure that the user is a member of the corresponding RADIUS group in JumpCloud with the exact same user name as on your appliance. JumpCloud now controls authentication, including enabling MFA without having to engage with FortiTokens or a third-party MFA solution.
This is an example of an existing FortiGate user:
This RADIUS user belongs to the appropriate JumpCloud Group
Reporting
JumpCloud’s Directory Insights captures and logs RADIUS authentications. It makes it possible to determine which user is attempting to access your resources and whether it was successful. Directory Insights is useful for debugging and testing your RADIUS configuration deployments.
Try JumpCloud RADIUS
JumpCloud’s full platform is free for 10 users and devices with premium chat support for the first 10 days to get your started. The open directory platform provides SSO to everything:
Need a Helping Hand? Reach out to professionalservices@jumpcloud.com for assistance to determine which Professional Service option might be right for you.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
