PowerShell Extension for Visual Studio Code August 2022 Update

This post was originally published on this site

We are excited to announce that the August update to the PowerShell Extension for Visual Studio Code is now available on the extension marketplace.

This release adds a walkthrough experience for getting started with PowerShell in VS Code, more regression tests, a major LSP client library update, and includes a number of bug fixes!

Updates in the August Release

Note that these updates all shipped in our PowerShell Preview Extension for VS Code before shipping in our stable channel.

Some highlights of August releases:

For the full list of changes please refer to our changelog.

Getting Started Walkthrough

As a part of this release we have introduced a getting started experience for PowerShell in VS Code. This experience was designed through a series of customer surveys and interviews conducted by our summer intern. The walkthrough can be accessed on the Getting Started page in VS Code, or through the command pallette.

image

We look forward to getting more feedback on this walkthrough and learning how we can improve it.

LSP Client Library Update

This release also includes a major update to our LSP client library dependency, vscode-languageclient. The extension uses this library to start, connect, and communicate with the LSP server, PowerShell Editor Services.

By incorporating this update in vscode-powershell #4128 we were able to prevent a number of race conditions that could be encountered during startup, as the latest version of this library allows us to register our notification and request handlers before starting the server. The lifecycle management code was also given some much needed attention, and so startup and shut-down is now a more stable experience.

Please note that due to an upstream change, there is now a second notification when the server is stopped. We are working with the upstream team to de-duplicate this popup, and are also contemplating enabling a configurable auto-restart of the server.

Getting Support and Giving Feedback

While we hope the new implementation provides a much better user experience, there are bound to be issues. Please let us know if you run into anything.

If you encounter any issues with the PowerShell Extension in Visual Studio Code or have feature requests, the best place to get support is through our GitHub repository.

Sydney Smith and Andy Jordan PowerShell Team

The post PowerShell Extension for Visual Studio Code August 2022 Update appeared first on PowerShell Team.

AA22-228A: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

This post was originally published on this site

Original release date: August 16, 2022

Summary

Actions for ZCS administrators to take today to mitigate malicious cyber activity:
• Patch all systems and prioritize patching known exploited vulnerabilities.
• Deploy detection signatures and hunt for indicators of compromise (IOCs).
• If ZCS was compromised, remediate malicious activity.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are publishing this joint Cybersecurity Advisory (CSA) in response to active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform. CVEs currently being exploited against ZCS include: 

  • CVE-2022-24682 
  • CVE-2022-27924 
  • CVE-2022-27925 chained with CVE-2022-37042 
  • CVE-2022-30333

Cyber threat actors may be targeting unpatched ZCS instances in both government and private sector networks. CISA and the MS-ISAC strongly urge users and administrators to apply the guidance in the Recommendations section of this CSA to help secure their organization’s systems against malicious cyber activity. CISA and the MS-ISAC encourage organizations who did not immediately update their ZCS instances upon patch release, or whose ZCS instances were exposed to the internet, to assume compromise and hunt for malicious activity using the third-party detection signatures in the Detection Methods section of this CSA. Organizations that detect potential compromise should apply the steps in the Incident Response section of this CSA.

Download the PDF version of this report: pdf, 355 kb

Technical Details

CVE-2022-27924

CVE-2022-27924 is a high-severity vulnerability enabling an unauthenticated malicious actor to inject arbitrary memcache commands into a targeted ZCS instance and cause an overwrite of arbitrary cached entries. The actor can then steal ZCS email account credentials in cleartext form without any user interaction. With valid email account credentials in an organization not enforcing multifactor authentication (MFA), a malicious actor can use spear phishing, social engineering, and business email compromise (BEC) attacks against the compromised organization. Additionally, malicious actors could use the valid account credentials to open webshells and maintain persistent access.

On March 11, 2022, researchers from SonarSource announced the discovery of this ZCS vulnerability. Zimbra issued fixes for releases 8.8.15 and 9.0 on May 10, 2022. In June 2022, SonarSource publicly released proof-of-concept (POC) exploits for this vulnerability.[1][2] Based on evidence of active exploitation, CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on August 4, 2022. Due to the POC and ease of exploitation, CISA and the MS-ISAC expect to see widespread exploitation of unpatched ZCS instances in government and private networks.

CVE-2022-27925 and CVE-2022-37042

CVE-2022-27925 is a high severity vulnerability in ZCS releases 8.8.15 and 9.0 that have mboximport functionality to receive a ZIP archive and extract files from it. An authenticated user has the ability to upload arbitrary files to the system thereby leading to directory traversal.[3] On August 10, 2022, researchers from Volexity reported widespread exploitation—against over 1,000 ZCS instances—of CVE-2022-27925 in conjunction with CVE-2022-37042.[4] CISA added both CVEs to the Known Exploited Vulnerabilities Catalog on August 11, 2022. 

CVE-2022-37042 is an authentication bypass vulnerability that affects ZCS releases 8.8.15 and 9.0. CVE-2022-37042 could allow an unauthenticated malicious actor access to a vulnerable ZCS instance. According to Zimbra, CVE-2022-37042 is found in the MailboxImportServlet function.[5][6] Zimbra issued fixes in late July 2022.

CVE-2022-30333

CVE-2022-30333 is a high-severity directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX allowing a malicious actor to write to files during an extract (unpack) operation. A malicious actor can exploit CVE-2022-30333 against a ZCS server by sending an email with a malicious RAR file. Upon email receipt, the ZCS server would automatically extract the RAR file to check for spam or malware.[7] Any ZCS instance with unrar installed is vulnerable to CVE-2022-30333.

Researchers from SonarSource shared details about this vulnerability in June 2022.[8] Zimbra made configuration changes to use the 7zip program instead of unrar.[9] CISA added CVE-2022-3033 to the Known Exploited Vulnerabilities Catalog on August 9, 2022. Based on industry reporting, a malicious cyber actor is selling a cross-site scripting (XSS) exploit kit for the ZCS vulnerability to CVE 2022 30333. A Metasploit module is also available that creates a RAR file that can be emailed to a ZCS server to exploit CVE-2022-30333.[10]

CVE-2022-24682

CVE-2022-24682 is a medium-severity vulnerability that impacts ZCS webmail clients running releases before 8.8.15 patch 30 (update 1), which contain a cross-site scripting (XSS) vulnerability allowing malicious actors to steal session cookie files. Researchers from Volexity shared this vulnerability on February 3, 2022[11], and Zimbra issued a fix on February 4, 2022.[12] CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on February 25, 2022. 

DETECTION METHODS

Note: CISA and the MS-ISAC will update this section with additional IOCs and signatures as further information becomes available. 
CISA recommends administrators, especially at organizations that did not immediately update their ZCS instances upon patch release, to hunt for malicious activity using the following third-party detection signatures:

Mitigations

CISA and the MS-ISAC recommend organizations upgrade to the latest ZCS releases as noted on Zimbra Security – News & Alerts and Zimbra Security Advisories.

See Volexity’s Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925 for mitigation steps.

Additionally, CISA and the MS-ISAC recommend organizations apply the following best practices to reduce risk of compromise:

  • Maintain and test an incident response plan.
  • Ensure your organization has a vulnerability management program in place and that it prioritizes patch management and vulnerability scanning of known exploited vulnerabilities. Note: CISA’s Cyber Hygiene Services (CyHy) are free to all state, local, tribal, and territorial (SLTT) organizations, as well as public and private sector critical infrastructure organizations: cisa.gov/cyber-hygiene-services
  • Properly configure and secure internet-facing network devices.
    • Do not expose management interfaces to the internet.
    • Disable unused or unnecessary network ports and protocols.
    • Disable/remove unused network services and devices.
  • Adopt zero-trust principles and architecture, including:
    • Micro-segmenting networks and functions to limit or block lateral movements.
    • Enforcing phishing-resistant multifactor authentication (MFA) for all users and VPN connections.
    • Restricting access to trusted devices and users on the networks.

INCIDENT RESPONSE

If an organization’s system has been compromised by active or recently active threat actors in their environment, CISA and the MS-ISAC recommend the following initial steps:

  1. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.
  2. Quarantine or take offline potentially affected hosts.
  3. Reimage compromised hosts.
  4. Provision new account credentials.
  5. Report the compromise to CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 888-282-0870). SLTT government entities can also report to the MS-ISAC (SOC@cisecurity.org or 866-787-4722).

See the joint CSA from the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States on Technical Approaches to Uncovering and Remediating Malicious Activity for additional guidance on hunting or investigating a network, and for common mistakes in incident handling. CISA and the MS-ISAC also encourage government network administrators to see CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. Although tailored to federal civilian branch agencies, these playbooks provide operational procedures for planning and conducting cybersecurity incident and vulnerability response activities and detail steps for both incident and vulnerability response. 

ACKNOWLEDGEMENTS

CISA and the MS-ISAC would like to thank Volexity and Secureworks for their contributions to this advisory.

DISCLAIMER

The information in this report is being provided “as is” for informational purposes only. CISA and the MS-ISAC do not provide any warranties of any kind regarding this information. CISA and the MS-ISAC do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring.

References

Revisions

  • August 16, 2022: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

Archive Module 2.0 Preview 2

This post was originally published on this site

We are excited to announce that the second preview of a rewrite of Microsoft.PowerShell.Archive, the module that lets you create and extract archives, is now available on the PowerShell Gallery.

This release is the second preview release of a rewrite of the module and is not feature complete. Please note that this release is only compatible with PowerShell 7.3.0-preview5 and up. For more information on what is proposed in this rewrite, or to give feedback on the design please refer to the RFC.

Installing the module

Please note that this release will only work with PowerShell 7.3.0-preview5 and up. Find and install the latest preview version of PowerShell here.

To install the Microsoft.PowerShell.Archive 2.0 preview 2 using PowerShellGet 2.2.5 run the following command

Install-Module Microsoft.PowerShell.Archive -AllowPrerelease

To install the Microsoft.PowerShell.Archive 2.0 preview 2 using PowerShellGet 3.0 previews run the following command

Install-PSResource Microsoft.PowerShell.Archive -Prerelease

Features of the release

This release contains the rewrite of the Expand-Archive cmdlet.

This cmdlet contains two parameter sets

Expand-Archive [-Path] <string> [[-DestinationPath] <string>] [-WriteMode {Create | Update | Overwrite}] [-PassThru] [-Filter <string[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Expand-Archive [-LiteralPath <string>] [-DestinationPath] <string>]  [-WriteMode {Create | Update | Overwrite}] [-PassThru] [-Filter <string[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Some features to note of this release

  • Added -WriteMode parameter to Expand-Archive
  • Added support for zip64
  • Fixed a bug where the entry names of files in a directory would not be correct when compressing an archive

Features of the next release

The next release will focus on additional features of the module. To track the progress of this release, look at this project in our GitHub repository.

Giving Feedback and Getting support

While we hope the new implementation provides a much better user experience, there are bound to be issues. Please let us know if you run into anything.

If you encounter any issues with the module or have feature requests, the best place to get support is through our GitHub repository.

Sydney

PowerShell Team

The post Archive Module 2.0 Preview 2 appeared first on PowerShell Team.

Announcing the release of Get-WhatsNew

This post was originally published on this site

We are pleased to announce the release of Get-WhatsNew, a cmdlet that delivers feature
information about new versions of PowerShell to your local terminal experience.

Stay informed with Get-WhatsNew

Between General Availability (GA), Long-Term Servicing (LTS), and Previews release, PowerShell ships
updates several times a year. At this pace, PowerShell users may become unaware of new features and
changes that improve automation, performance and security. Today, this information is provided through
release notes and the PowerShell
GitHub repository. Get-WhatsNew enables you to:

  • Learn about new features that enable new solutions
  • Get version-specific information to make upgrade decisions
  • View the information in disconnected scenarios (data ships with module)
  • View the information in Windows PowerShell 5.1 and higher
  • Get information for a single random feature for a message-of-the-day (MOTD) experience
  • Quickly open the release notes on the web version using the Online option

Installing WhatsNew

The Get-WhatsNew cmdlet ships in the
Microsoft.PowerShell.WhatsNew
module, which can be installed from the PowerShell Gallery.

Requirements:

  • Microsoft.PowerShell.WhatsNew is a cross platform module that requires Windows PowerShell 5.1
    or higher

To install Microsoft.PowerShell.WhatsNew:

Install-Module -Name Microsoft.PowerShell.WhatsNew

To install Microsoft.PowerShell.WhatsNew using the new
PowerShellGet.v3

Install-PSResource -Name Microsoft.PowerShell.WhatsNew

Using Get-WhatsNew

Get-WhatsNew displays PowerShell features by version. The cmdlet includes
complete help with several examples. Here are some highlights to get started:

To get the complete help information for Get-WhatsNew

Get-Help Get-WhatsNew -Full

To display the release notes for the version of PowerShell in which the cmdlet is running.

Get-WhatsNew

To display the release notes for PowerShell 7.2 regardless of which version the cmdlet is running.

Get-WhatsNew -Version 7.2

To display one randomly selected section of the release notes per version of PowerShell selected.
Add this to your profile to receive a Message-Of-The-Day (motd).

Get-WhatsNew -Daily -Version 6.0, 7.0, 7.1, 7.2

Future plans

We value your ideas and feedback and hope you will give WhatsNew a try. Stop by our
GitHub repository and let us know of any issues you find
or features you would like added.

The post Announcing the release of Get-WhatsNew appeared first on PowerShell Team.