Hello and welcome to the Friday, April 11th, 2025
edition of the SANS Internet Storm Center's Stormcast. My
name is Johannes Ullrich and today I'm recording from
Jacksonville, Florida. Well, when you hear about recent
attacks by Volt Typhoon, the Chinese threat actor who has
been compromising critical infrastructure, you usually
think about cutting-edge, serity-style exploits. Sadly,
that's not all there is to it. There are also a lot of good
old overlooked vulnerabilities. And that's
what today's diary is about. One of our undergraduate
interns, Matthew Gorman, looked at CVE 2018-0171. This
is, as the CVE number implies, an older vulnerability, but
still currently being actively exploited by threat actors
like Volt Typhoon. So, definitely something to not
overlooking infrastructure. And Matthew does a great job
here in walking you through some of the issues with these
vulnerabilities, how it's being exploited and how to
protect yourself from exploitation. Also, why some
of these vulnerabilities are still a problem. And then we
got a little bit more cleanup for the Microsoft Patch
Tuesday this week. There were issues with Windows Hello,
most importantly. Some users experienced after rebooting
their system, they could no longer log in via their PIN or
via facial recognition with Windows Hello. Apparently,
this affects systems where System Guard Secure Launch or
Dynamic Route of Trust for measurement. DRTM is enabled.
The solution here is to re -enroll your device. There
were also updates affecting Citrix and, most importantly,
some Roblox users apparently are having problems. There was
also an issue with Microsoft Office crashing. This only
affected systems that use the MSI-based installer for
Microsoft Office. And Microsoft on Thursday did
release a special update to fix this particular problem.
And on a positive note, the Windows 10 version of the
April updates is now available as well. And Dell released an
update for users of its network-attached storage
system, PowerScale 1FS. One particular vulnerability here
is worth pointing out, the CVSS score of 9.8. And it
fixed, well, one of those good old backdoor passwords. So a
default password is being addressed with this update. At
this point, I haven't seen what the password is, but
probably just a matter of time, meaning hours or a
couple days, for that to become publicly known. Well,
in Horizon 3, they published a detailed breakdown of a
vulnerability they recently discovered in Langflow. The
vulnerability was discovered end of February, was reported,
and was then fixed end of March by Langflow. Version 1
.30 is the safe version you want to use. The nature of
this vulnerability is that Langflow has an
unauthenticated API endpoint. Never a good idea. In this
particular case, data is then actually being passed to a
Python exec. Now, it's not super straightforward. It's
not just simple Python code that you're able to execute
here. You have to sort of obfuscate a little bit, make
it work with this particular endpoint. And that involves
the use of Python decorators. Interesting Python feature
that myself, as a non-real big Python person, wasn't really
familiar with. But this will walk you through how the
exploit works. And yes, they do provide proof-of-concept
exploit. At this point, I see, as of today, one single hit to
the particular API endpoint in our honeypots. Wouldn't call
it a successful or attempted exploit. Really more recon
because it doesn't appear to have the actual exploit
attached sort of as a body. But still have to look at it
in more detail. Definitely, if you are running Langflow,
update it now. And definitely don't expose this tool to the
internet. But then again, it's AI. So what could possibly go
wrong? Well, and this coming week, I will be in Orlando at
our big spring event there. I'll be teaching defending web
applications. I think I'm scheduled to do a quick
luncheon learn. So if you're interested, hope to see some
of you. If you're not in class with me, always usually carry
some stickers around. So just stop me if you see me in the
hallway. And if you're interested in some internet
storms and our stickers, maybe I'll drop some on a random
table in the hallways there. Well, that's it for today. So
thanks again for listening and talk to you again on Monday.
Bye.
