Advisories 20230829 001,002 (#315)

Advisories 20230829 001,002.

Co-authored-by: Adon Metcalfe <adon.metcalfe@dpc.wa.gov.au>

docs/advisories/20230829001-KnownExploited-WinRAR-Code-Execution.md

@@ -0,0 +1,34 @@
+# RARLAB WinRAR Code Execution Vulnerability added to CISA Known Exploited Catalog - 20230829001
+
+## Overview
+
+CISA has added **CVE-2023-38831** to their [Known Exploited Vulnerability Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).
+
+RARLabs **WinRAR before 6.23** allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
+CISA reports this was exploited in the wild in April through August 2023.
+
+## What is the vulnerability?
+
+[**CVE-2023-38831**](https://www.cve.org/CVERecord?id=CVE-2023-38831) - CVSS v3 Base Score: ***TBA***
+- The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.
+
+## What is vulnerable?
+
+The vulnerability exists in the following products:
+
+- WinRAR versions **below 6.23**
+
+## What has been observed?
+
+There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *two weeks...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- <https://www.rarlab.com/rarnew.htm>
+
+### Additional Resources
+
+- Bleeping Computer: "WinRAR zero-day exploited since April to hack trading accounts" - <https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/>
+- Group-IB: "Traders' Dollars in Danger: CVE-2023-38831 zero-Day vulnerability in WinRAR exploited by cybercriminals to target traders" <https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/>

docs/advisories/20230829002-KnownExploited-Ignite-Realtime-Openfire.md

@@ -0,0 +1,36 @@
+# Ignite Realtime Openfire Path Traversal Vulnerability added to CISA Known Exploited Catalog - 20230829002
+
+## Overview
+
+CISA has added **CVE-2023-32315** to their [Known Exploited Vulnerability Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).
+
+Openfire's administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.
+
+## What is the vulnerability?
+
+[**CVE-2023-32315**](https://nvd.nist.gov/vuln/detail/CVE-2023-32315): CVSS v3 Base Score: ***7.5***
+- An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community.
+
+## What is vulnerable?
+
+This vulnerability **affects all versions of Openfire that have been released since April 2015**, including the following versions:
+
+- 3.10.0, 3.10.1, 3.10.2, 3.10.3
+- 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4
+- 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6
+- 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4
+- 4.3.0, 4.3.1, 4.3.2
+- 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4
+- 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6
+- 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, 4.6.6, 4.6.7
+- 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4
+
+## What has been observed?
+
+CISA added this vulnerabilty in their [Known Exploited Vulnerabilties](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) catalog. There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *two weeks...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- <https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm>

docs/markdown-templates/advisory-KnownExploited.md

@@ -1,4 +1,4 @@
-# TIBCO JasperReports Library Vulnerability - 20230104001
+# (Vulnerability) added to CISA Known Exploited Catalog - YYYYMMDD###
 
 ## Overview
 
@@ -8,7 +8,7 @@ The impact of this vulnerability includes the theoretical possibility that a web
 
 ## What is the vulnerability?
 
-[**CVE-XXXX-XXXXX**](https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX) - CVSS v3 Base Score: ***X.X***
+[**CVE-XXXX-XXXXX**](https://www.cve.org/CVERecord?id=CVE-XXXX-XXXXX) - CVSS v3 Base Score: ***X.X***
 
 ## What is vulnerable?
 
@@ -26,4 +26,8 @@ CISA added this vulnerabilty in their [Known Exploited Vulnerabilties](https://w
 
 The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *two weeks...* (refer [Patch Management](../guidelines/patch-management.md)):
 
-- [Vendor URL Here](Same URL Here)
+- <Vendor URL Here>
+
+### Additional Resources
+
+-