Tag Archives: Qradar

Remote Code Execution – IBM QRadar / Robin Weser Fast Loops (CVE-2024-39008)

Leave a reply

Remote Code Execution - IBM QRadar / Robin Weser Fast Loops (CVE-2024-39008)

Remote Code Execution – IBM QRadar / Robin Weser Fast Loops (CVE-2024-39008). On August 14, a security bulletin for QRadar Suite Software and IBM Cloud Pak for Security was published on the IBM website. It lists fixed vulnerabilities in IBM QRadar itself and its open source components: Node.js, Jinja, kjd/idna, robinweser/fast-loops. The vulnerability of the last project is the most interesting.

🔻 robinweser/fast-loops – a set of compact utilities for faster work with JavaScript arrays and objects. This is not a very popular project, only 25 stars and 3 forks on GitHub.

🔻 The vulnerability CVE-2024-39008 allows an attacker to send special requests and, potentially, cause a DoS and RCE. There are technical details and a PoC.

Ok, the open source component is vulnerable. But how to exploit the vulnerability in QRadar itself? It is still unknown. 🤷‍♂️ But it is better not to wait for the details to appear, but to update QRadar in advance. 😉

На русском

PHDays VI: The Standoff

3 Replies

PHDays VI: The Standoff. A week ago I was at PHDays (Positive Hack Days) 2016 conference. For those who don’t know, there are two main events for security practitioners in Russia: PHDays in May and ZeroNights in November. Day-Night. Like this play on words. =)

phdays_logo

So, it was my 6th PHDays. I visited them all. But on this one for a first time I was as an ordinary visitor and not from organizers side. To be honest, I have never participated in organizing of PHDays, and just seen the final result. So, nothing changed much for me. As usual, organization was at very high level. And it’s not just my opinion, but the opinion of many participants.

Sad things first. And they are likely sad only for me. You know my passion to vulnerability assessment/management systems and scanners. So, despite the fact that Positive Technologies are the organizers of this event and Maxpatrol is still their’s flagman product, it was hard to hear anything related to vulnerability assessment/risk assessment/threat intelligence on PHDays. Isn’t it strange? Could you imagine this at Qualys QSC or Tenable event? Nothing much about critical controls and IT compliance in general.

It’s clear that vulnerability assessment is not already in trends in Russia. All are crazy about SIEM and slightly less about Anti-APT and SCADA security. Sad, but true.

Anyway, I have seen many interesting presentations about honeypots, computer forensics, machine learning and security startups. I also visited a SIEM roundtable with representatives of Positive Technologies, First Russian SIEM (RuSIEM), ArcSight, IBM Qradar, Splunk, and Cisco Systems. More details under the cut.

Continue reading →