Features Released in January 2021 - 1.0 - Cortex XPANSE - Cortex - Security Operations

OpenSSL—Low – OpenSSL is a commonly used toolkit and cryptography library for TLS and SSL protocols. This issue identifies OpenSSL strings in HTTP, FTP, and SSH data.

VMware vSphere—Medium – VMware vSphere is an enterprise virtualization platform for managing fleets of servers, virtual machines, and ESXi/ESX hypervisors. This issue identifies vSphere administration clients that are exposed to the internet.

Cisco Secure Web Appliance—Medium

Unclaimed S3 Bucket—High – Amazon Simple Storage Service (or Amazon S3) is a service offered by AWS that provides object storage through a web interface. S3 buckets serve as the containers for objects, similar to file folders, and can also be configured for website hosting to serve static content as web servers. S3 buckets are bound to a particular domain. When a domain name (CNAME record) points to an S3 bucket that is not defined, anyone can register the S3 bucket, place content there and masquerade as the company. This is one instance of what’s known as subdomain hijacking.

JetBrains TeamCity Server—Medium – TeamCity is a continuous integration/continuous delivery (CI/CD) platform used to automatically test and build software from a source code repository. Compromise of a TeamCity deployment or other CI/CD service could allow an adversary to compromise the software being built to create a downstream security risk, access source code, or pivot elsewhere within a target network. As a result, TeamCity servers generally should not be exposed to the public Internet.

Default Apache Tomcat Page—Low – This issue shows that a default Apache Tomcat landing page has been found. This can be a proxy for finding the Tomcat Management Portal as the landing page contains a button with a link to the management app. While the discovery scan does not actually “click the button” to download and run the management app, it flags the presence of the button displayed on the default landing page. Compromise of a Tomcat landing page could allow an adversary to connect to the management portal, change the configuration, upload new applications, or run arbitrary code on the server.