VMware denies claims it leaked Confluence RCE exploit

[ad_1]

Identical payload removed from GitHub after searcher complaints

VMware has refuted accusations that it disclosed an exploit for a critical vulnerability in Confluence that independent security researchers designed for its servers.

In a blog post published on September 7, researcher Thanh Nguyen alleged that a payload surfaced on GitHub that was identical to a pre-authentication remote code execution (RCE) exploit he had. sent to virtualization and cloud specialist 17 hours earlier.

Nguyen pointed out that no PoC [proof of concept] was public on the Internet at that time.

BACKGROUND The Jenkins Project succumbs to massive exploitation of the critical vulnerability of the Atlassian Confluence

The fact that the original payload was specifically designed for a VMWare endpoint (confluence.eng.vmware.com) supported their belief that this was a VMWare leak, he argued. .

Echoing denials given to Nguyen, VMWare told the Daily Swig that it found no evidence that VMware disclosed the exploit publicly.

Timeline of an alleged leak

Nguyen said he sent the original exploit, which bypassed VMWares WAF, to the enterprise technology company through its vulnerability disclosure program on August 31. It was developed with the help of fellow researcher Janggggg.

The alleged duplicate payload appeared on the Nuclei project in an extract request for CVE-202126084, which Atlassian, the developer of Confluence, corrected and which has been the target of widespread exploitation attempts.

The maintainer of Nucleis removed the exploit after Nguyen and Janggggg demanded its provenance, Nguyen said.

The researcher who posted the controversial payload on Nuclei, Dhiyaneshwaran, told The Daily Swig: I didn’t create the exploit. I just discovered [a] Linked HTTP request [to] this feat via Pastebin scratching.

They added: My tool does not keep track of the source URL.

Keep up to date with the latest news on the Vulnerability Disclosure Policy (VDP)

In response to an email from Nguyen and Janggggg, the VMWares security team wrote: In accordance with our policy, we do not disclose any reported vulnerabilities to VMWare nor do we disclose any exploits, vectors of payload attack, etc.

Citing a third exploit for the same Confluence bug published by Rahul Maini and Harsh Jaiswal, they added: We observed that the exploit was made public by other security researchers and that VMWare did not make it public.

However, Nguyen rejected the relevance of Maini and Jaiswals’ article because the payload differed and it was published a few hours after the Nuclei extract request emerged.

Very clear to us

As the exploit payload we sent to VMWare was specifically designed for their server and we did not use this payload on any other targets and / or sent it to other companies / bounty programs of bugs it is very clear to us that our payload has been leaked somehow. from VMWare to the Nuclei project, Nguyen said.

The exploit we sent to VMWare is our copyrighted property and we have not granted VMWare the right to redistribute it, he continued, adding that VMWare had stopped responding to his emails.

A VMware spokesperson told The Daily Swig:

VMware values ​​our relationship with the research community because their contributions help us protect our customers and improve our products. We also work hard to maintain researchers’ confidence in our bug bounty program by adhering to generally accepted protocol and acting in good faith when exploits are reported to us.

In this case, we informed the researcher that we found no evidence that VMware disclosed the exploit publicly. Building confidence in our bonus program is important to us, and we continue to review our processes to find opportunities for improvement.

Researcher Thanh Nguyen has yet to respond to our requests for comment, but we will update the article if and when he does.

RECOMMENDED Spook.js New Side Channel Attack May Bypass Google Chromes’ protections against Specter-type exploits

[ad_2]