Podcast Detail

SANS Stormcast Tuesday, July 28th, 2026: Spring Boot Scans; VBulletin Vulnerability; MSFT Defender for Linux; MongoDB Update

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10026.mp3

previous
Podcast Logo
Spring Boot Scans; VBulletin Vulnerability; MSFT Defender for Linux; MongoDB Update
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday, July 28, 2026 edition
 of the SANS Internet Storm Center's Stormcast. My name is
 Johannes Ullrich, recording today from Jacksonville,
 Florida. And this episode is brought to you by the SANS.edu
 Graduate Certificate Program in Penetration Testing and
 Ethical Hacking. Our honeypots picked up a variation of
 Spring Boot heap dump scans. So in Spring Boot, the Java
 framework, there is an endpoint actuator slash heap
 dump. If you access this particular endpoint, you get,
 well, as the name implies, a heap dump back. Heap dump in
 Java is essentially what the core dump is in binary
 programs. And it includes essentially a memory snapshot
 of the process. Memory snapshots then tend to include
 things like credentials, API keys, and all kinds of other
 interesting confidential stuff. What's a little bit
 different here is that the attacker is using an admin
 slash API prefix to the endpoint. This is not that
 terribly unusual. It's easily configured within Spring Boot.
 They're not assuming that the endpoint is not password
 protected. There has been a vulnerability where people did
 install Spring Boot, then didn't password protect the
 actuator heap dump endpoint. In this case, they're
 attempting some simple passwords, like for example,
 username admin, password admin. Well, still works. It's
 the AIH, but admin admin still apparently gets you all the
 credentials that you need. And the vBulletin Secure
 Disclosure technical team released details regarding new
 vulnerability in vBulletin. vBulletin is still very
 popular bulletin board software installed on I don't
 know how many, but a lot of different websites. The
 vulnerability is a standard remote code execution
 vulnerabilities. Data is being passed to the PHP exec
 function. Never a good idea. In particular, if all you do
 is attempting some simple cleanup, removing some sort of
 bad characters. Well, as always, they were not complete
 in their cleanup. And now we have a remote code execution.
 Remember, when you're doing an exec call or such, first of
 all, you shouldn't really be doing it. And if you must do
 it, they're more secure APIs, exec v and such that separate
 the code from the command line arguments that give you a
 slightly better chance of actually not landing in this
 very well known old trap. And if you're using Microsoft's
 defender solution for Linux, well, Microsoft did recently
 push out an update that prevents defender from
 restarting if the system is being rebooted. Now, this is
 an update to their scanning engine, which usually is
 enabled by default. And the problem here is if you
 received the bad update, and then you rebooted the system
 before the next update that fixed the problem was
 installed. Well, in that case, defender didn't start and will
 also not update automatically. So you must basically follow
 Microsoft's manual remediation steps in order to get Windows
 defender to launch again. Windows defender for servers
 is a very popular solution for Linux these days. So yes,
 Microsoft does make some of its software for Linux as
 well. And MongoDB released patches for 26 different
 vulnerabilities. And now many of them are rated high. There
 is one vulnerability that's rated critical, because it
 does allow for some memory corruption and also corruption
 of data inside the database. Now, this is not exploitable
 in the default configuration, you must enable the compute
 mode and you must use a standalone MongoDB instance.
 Compute mode is usually not enabled. In this case, the
 external attacker would then have to send BSON data, so
 binary JSON data to the MongoDB database. And then the
 aggregation pipeline will lead to the memory corruption. So
 definitely something that you do want to update. Like I
 said, there are also a number of high vulnerabilities, many
 of them leading to various denial of service conditions.
 And yes, it doesn't appear to be that some of them are that
 terribly difficult to exploit. Well, and this is it for
 today. So thanks for listening. Thanks for liking.
 Thanks for subscribing to this podcast. And talk to you again
 tomorrow. Bye.
 Bye.