Security news weekly round-up - 27th November 2020
Tags: security
Published: 2020-11-27 20:48:15

---
title: Security news weekly round-up - 27th November 2020
published: true
description: Curated links about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/pyy42pwiihy23jhw2v7f.jpg
series: Security news weekly round-up
---

## __Introduction__

This week it's all about _bugs_ 🐛.

<hr>

## __[TikTok fixes bugs allowing account takeover with one click](https://www.bleepingcomputer.com/news/security/tiktok-fixes-bugs-allowing-account-takeover-with-one-click/)__

The bugs were discovered by fuzzing by German bug bounty hunter Muhammed Taskiran and it affected accounts which had used third-party apps to sign-up for TikTok

Excerpt from the article:

> German bug bounty hunter Muhammed Taskiran discovered a reflected cross-site scripting (XSS) security bug — also known as a non-persistent XSS — in a TikTok URL parameter reflecting its value without proper sanitization.

> Taskiran found the reflected XSS that could have also lead to data exfiltration while fuzz testing the company's `www.tiktok.com` and `m.tiktok.com` domains.

## __[VMware discloses critical zero-day vulnerability in Workspace One](https://www.bleepingcomputer.com/news/security/vmware-discloses-critical-zero-day-vulnerability-in-workspace-one/)__

The title says it all.

Excerpt from the article:

> The vulnerability tracked as CVE-2020-4006 is a command injection bug — with a 9.1/10 CVSSv3 severity rating — found in the administrative configurator of some releases of VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector.

> "A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system," according to VMware's advisory.

## __[Tesla Model X key fobs could be hacked to steal cars, fix released](https://www.bleepingcomputer.com/news/security/tesla-model-x-key-fobs-could-be-hacked-to-steal-cars-fix-released/)__

Your fancy Tesla Model X could be stolen in minutes.

Excerpt from the article:

>  The security bugs allowed taking full control of the key fob and of the car by remotely updating the Tesla Model X's BLE chip with specially crafted firmware.

> Once the key fob was compromised, the researchers were able to capture valid unlock messages which allowed them to unlock the car at any time.

## __[TikTok Awards Nearly $4,000 for Account Takeover Vulnerabilities](https://www.securityweek.com/tiktok-awards-nearly-4000-account-takeover-vulnerabilities)__

The _one-click_ attack discussed earlier in this article.

Excerpt from the article:

> TikTok classified the issue as “high severity” and awarded the researcher $3,860 for his findings. The company has partially disclosed the vulnerability report — very few technical details have been shared.

## __[2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software](https://thehackernews.com/2020/11/2-factor-authentication-bypass-flaw.html)__

2-Factor authentication adds an extra layer of protection to a user account turns out it can be bypassed in cPanel and Web Host Manager.

Excerpt from the article:

> The issue stemmed from a lack of rate-limiting during 2FA during logins, thus making it possible for a malicious party to repeatedly submit 2FA codes using a brute-force approach and circumvent the authentication check.

## __[Drupal issues emergency fix for critical bug with known exploits](https://www.bleepingcomputer.com/news/security/drupal-issues-emergency-fix-for-critical-bug-with-known-exploits/)__

Drupal is a Content Management System written in PHP.

Excerpt from the article:

> Drupal has released emergency security updates to address a critical vulnerability with known exploits that could allow for arbitrary PHP code execution on some CMS versions.

## __[Unofficial Patch Released for Windows 7 Zero-Day Vulnerability](https://www.securityweek.com/unofficial-patch-released-windows-7-zero-day-vulnerability)__

The title says it all.

Excerpt from the article:

> An unofficial patch is now available through ACROS Security’s 0patch service for a zero-day vulnerability identified earlier this month in Windows 7 and Windows Server 2008 R2.

> The privilege escalation flaw, detailed by security researcher Clément Labro on November 12, exists because all users have write permissions for `HKLM\SYSTEM\CurrentControlSet\Services\Dnscache` and `HKLM\SYSTEM\CurrentControlSet\Services\RpcEptMapper`, two keys that could be used for code execution.

## __Credits__

Cover photo by [Jazmin Quaynor](https://unsplash.com/@jazminantoinette) on [Unsplash](https://unsplash.com/).

<hr>

That's it for this week, I'll see you next Friday <b>*</b>.

_Update December 4, 2020: Grammar fix and added <b>*</b>._