Security advisory: critical PHP and Node.js vulnerabilities are being exploited in the wild. What you need to do →
All months

Radar · 2023-03

March 2023

A signed 3CX desktop client is trojanised in a supply-chain attack and reaches hundreds of thousands of organisations, an unauthenticated flaw in WooCommerce Payments hands over administrator access on 500,000 sites, Apache httpd patches request splitting through mod_rewrite, GPT-4 ships and the OAIC opens inquiries into the Latitude Financial breach.

What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.

AI platform and models

Sections
  • fyi OpenAI

    GPT-4 ships — openai.com

    Released 14 March 2023 as a text-and-image-input, text-output model, though image input shipped only as a research preview. Two context sizes were offered: 8,192 tokens and 32,768 tokens, the latter roughly fifty pages. Launch API pricing was US$0.03 per thousand prompt tokens and US$0.06 per thousand completion tokens for the 8K variant, behind a developer waitlist, with ChatGPT Plus subscribers getting usage-capped access from launch day. OpenAI claimed roughly top-decile performance on a simulated bar exam against bottom-decile for GPT-3.5, and a score 40 per cent higher than the latest GPT-3.5 on OpenAI's internal adversarial factuality evaluations. OpenAI said GPT-4 significantly reduces hallucinations but is still not fully reliable.

    This is the reference point for dating anything AI-related in a codebase or proposal: work assuming GPT-4-class reasoning cannot predate 14 March 2023. Note the waitlist — API access at launch was by developer waitlist, so a product claiming GPT-4 in production soon after launch was probably still on the waitlist or running 3.5.

  • fyi Anthropic

    Claude and Claude Instant reach general availability — anthropic.com

    On 14 March 2023 Anthropic moved Claude out of closed alpha with Notion, Quora and DuckDuckGo and made two models available through a chat interface and an API: Claude, the high-performance model, and Claude Instant, lighter, cheaper and considerably faster. Anthropic also names Juni Learning, Robin AI and AssemblyAI as customers.

    If you are tracing when the Claude model line became commercially available, this is the announcement.

  • fyi OpenAI

    ChatGPT plugins introduce tool use, and name prompt injection as a risk — openai.com

    Introduced 23 March 2023 with three first-party plugins: web browsing, restricted to GET requests and deliberately excluding form submission; Code Interpreter, a sandboxed Python environment with no external network access; and an open-source, self-hosted Retrieval plugin searching organisational documents using embeddings plus a vector database. OpenAI's own post states that red-teaming surfaced prompt injection and fraudulent email generation as concerns.

    Two uses. This is an architectural template — browsing, a code sandbox and retrieval over your own documents — worth knowing when assessing a supplier's claim of novelty. And OpenAI naming prompt injection in a launch post is a useful citation when arguing that injection risk was known at launch.

Security and edge

Sections
  • notable Apache

    Apache httpd patches request splitting through mod_rewrite and mod_proxy — httpd.apache.org

    Released 7 March 2023, Apache HTTP Server 2.4.56 fixed CVE-2023-25690, rated Important and affecting 2.4.0 through 2.4.55. Configurations combining a RewriteRule or ProxyPassMatch pattern that captures untrusted request input and substitutes it into the proxied URL allow request splitting: an attacker can inject a second request that bypasses the front end's access controls, poisons a shared cache, or reaches internal endpoints. The same release fixed CVE-2023-27522, a response-splitting flaw in mod_proxy_uwsgi where a malicious backend can terminate the response early.

    Audit every RewriteRule that uses a regex capture in a proxy substitution, then upgrade to 2.4.56.

  • notable CA/Browser Forum

    Ballot SC062v2 tightens certificate profiles — cabforum.org

    Published 17 March 2023 after voting closed on 16 March, SC062v2 rewrote Section 7 of the TLS Baseline Requirements covering certificate, CRL and OCSP profiles, specifying certificate content far more precisely and aligning expectations between issuers and consumers. It passed unanimously — 30 to nil among certificate issuers and 3 to nil among certificate consumers. The changes became normative on 15 September 2023, so certificates issued from that date must conform.

    Characterised as clarification rather than new requirements, but the practical effect is less tolerance for non-conforming extensions and encodings. If you run an internal CA mirroring the public requirements, or you parse certificate fields in edge logic, this is the 2023 baseline to diff against — and the September effective date is the deadline, not the March ballot.

  • notable curl

    curl 8.0.0 fixes GSS delegation reuse across connections — curl.se

    Published 20 March 2023 with curl 8.0.0, CVE-2023-27536 is libcurl reusing a pooled connection after the GSS delegation setting had changed, so a later Kerberos or Negotiate transfer could inherit unintended delegation permissions. Sibling advisories on the same day cover the same reuse class for FTP (CVE-2023-27535) and SSH (CVE-2023-27538).

    Upgrade to 8.0.0 wherever you use libcurl server-side with mixed credentials or mixed authentication settings on a shared handle — a common pattern in origin-fetch and webhook code. The check worth making is whether a multi handle is shared across security contexts.

Standards and compliance

Sections
  • notable ASD

    ASD publishes the March 2023 Information Security Manual — cyber.gov.au

    ASD published the March 2023 Information Security Manual on 2 March, with a change summary alongside it. The largest addition is a block of Microsoft Active Directory Domain Services hardening controls, ISM-1827 to ISM-1847, covering domain controllers, account hardening, security group memberships and rotation of the KRBTGT account credentials. Three new controls point web application and API development at OWASP: the Top Ten Proactive Controls, the OWASP Top 10 and the OWASP API Security Top 10 (ISM-1849 to ISM-1851). The protect principle on reducing attack surface now says systems are "designed and configured", to support secure-by-design. The ISM is the control set behind IRAP assessment and behind PSPF Policy 11, so each quarterly release is a delta to map rather than a document to reread.

    Reconcile each release against your system security plan and your clients' authorisation evidence. Agencies routinely ask hosting and platform vendors which ISM release their plan is mapped to, and the quarterly cadence means the answer goes stale four times a year.

  • notable OAIC

    OAIC opens inquiries into the Latitude Financial breach — oaic.gov.au

    The OAIC confirmed on 27 March 2023 that it was making preliminary inquiries into Latitude Financial's cyber incident. Latitude's update to the ASX that day put the theft at approximately 7.9 million Australian and New Zealand driver licence numbers, approximately 53,000 passport numbers and a further approximately 6.1 million records dating back to at least 2005. The OAIC statement restated the notification threshold and pointed affected people to Latitude's incident page and the IDCARE identity support service.

    This is the case that made identity-document retention a central compliance question: the harm came from historic copies of ID documents kept long after the onboarding that required them. Any client system capturing ID for verification — grant portals, licensing, account creation — inherited a concrete deletion obligation from it.

    Update, May 2023: The OAIC and New Zealand's Office of the Privacy Commissioner opened a joint investigation into the Latitude group's personal information handling on 10 May 2023.

  • fyi OAIC

    Secondary notifications of the same incident nearly double — oaic.gov.au

    The OAIC's half-year Notifiable Data Breaches report, published 1 March 2023, covers July to December 2022. It records 497 notifications, a 26 per cent increase on the 393 notified in January to June 2022. Malicious or criminal attack drove 350 of them, human error 123 and system fault 24. Forty breaches affected more than 5,000 Australians, up from 24, and five affected more than a million. Secondary notifications — extra filings for the same incident, discussed in the report's third-party service-provider section — rose 91 per cent, from 22 to 42. Eight of those 40 large-scale breaches involved a service provider relationship.

    The secondary-notification figure is the one to quote to a government or enterprise client: a breach at a hosting, CMS, analytics or forms vendor is now a routine cause of the client's own notifiable breach. It is the number underneath contractual demands for breach-notification timeframes, subprocessor disclosure and evidence of a vendor's own controls.

CMS and platforms

Sections
  • critical WordPress

    WooCommerce Payments flaw allows unauthenticated administrator takeover — thehackernews.com

    Disclosed in WooCommerce's 23 March 2023 advisory, a flaw in the WooCommerce Payments plugin let an unauthenticated attacker impersonate an administrator and take over a site with no user interaction or social engineering, affecting more than 500,000 installations on versions 4.8.0 to 5.6.1. WooCommerce worked with WordPress to auto-update affected sites, shipped nine fixed builds (4.8.2 to 5.6.2) and disabled the WooPay beta. There was no evidence of exploitation at disclosure.

    Patch, then treat it as an incident rather than a fix: check for unauthorised administrator accounts, rotate administrator passwords, and rotate payment gateway and WooCommerce API keys.

    Update, July 2023: Large-scale exploitation of the flaw, tracked as CVE-2023-28121 (CVSS 9.8), began in mid-July 2023, peaking at 1.3 million attacks against 157,000 sites on 16 July.

  • notable Drupal

    Three Drupal core advisories land in one window — drupal.org

    Published 15 March 2023. SA-CORE-2023-002, rated 14 out of 25, covers the Media module showing thumbnails of media items — including private files — to users without access. SA-CORE-2023-003, rated 13 out of 25, covers the language switcher block exposing URLs of unpublished translations, which combined with Pathauto can leak unpublished content titles. SA-CORE-2023-004, rated 14 out of 25, covers a phpinfo() diagnostic page an attacker with an existing cross-site scripting foothold could use to escalate; it also affects Drupal 7.

    Update to 10.0.5, 9.5.5 or 9.4.12, and take 7.95 on any surviving Drupal 7. Drupal 8 was already end of life and received no fix, which is the practical argument for the upgrade rather than the advisory itself.

  • notable WordPress

    WordPress 6.2 takes the Site Editor out of beta — wordpress.org

    Released 29 March 2023 and named for the jazz woodwind player Eric Dolphy, WordPress 6.2 was the first major release of the year. It moved the Site Editor out of beta, added the Style Book and Openverse media integration, and shipped distraction-free writing.

    For anyone maintaining WordPress fleets this is the baseline that makes full site editing production viable, which means theme and plugin compatibility testing against the Site Editor stops being optional for block themes.

Supply chain, CI/CD and IaC

Sections
  • critical 3CX

    A signed 3CX desktop client is trojanised in a supply-chain attack — bleepingcomputer.com

    On 29 March 2023 BleepingComputer reported a digitally signed, trojanised 3CX DesktopApp being used against the company's customers in a supply-chain attack. 3CX's phone system is used by more than 600,000 companies worldwide. The installer dropped malicious ffmpeg.dll and d3dcompiler_47.dll used for DLL sideloading; the decrypted payload could harvest system information and steal stored credentials from Chrome, Edge, Brave and Firefox profiles. Customers reported alerts after installing Windows 18.12.407 and 18.12.416, and Mac 18.11.1213 and later. 3CX said one of the bundled libraries compiled into the Windows Electron app via GIT was involved. MITRE assigned CVE-2023-29059 on 30 March.

    Treat a signed, auto-updating desktop client as an egress path outside the CDN and WAF perimeter. The trojanised build carried a legitimate 3CX certificate, so code signing showed who shipped it, not that it was clean. Inventory what auto-updates on staff machines with the same rigour you apply to server dependencies.

  • critical GitHub

    Weekly full-day brownouts break CI for anyone still on Ubuntu 18.04 — github.com

    GitHub's ubuntu-18.04 runner retirement escalated in March to four full-day brownouts — 6, 13, 21 and 28 March, each from 00:00 UTC to 00:00 UTC the next day. GitHub's target removal date was 1 April 2023, with the image fully unsupported by 3 April 2023.

    Subscribe to the actions/runner-images deprecation issues rather than discovering brownouts from red builds. Workflows still on the ubuntu-18.04 label should move to a supported runner image.

  • fyi PyPI

    PyPI launches an official blog — blog.pypi.org

    On 21 March 2023 PyPI launched blog.pypi.org as the official blog of the Python Package Index. PyPI said it would use the blog to announce new features and updates and to give context around PyPI and related PSF work, after a common refrain of "I didn't realize that PyPI…".

    Add it to whatever feed your team uses for supply chain watch.

    Update, May 2023: PyPI announced that every account maintaining a project or organisation must enable two-factor authentication by the end of 2023.

Languages, runtimes and frameworks

Sections
  • notable Go

    Go patches incorrect results in P-256 scalar multiplication — pkg.go.dev

    Released 7 March 2023, Go 1.19.7 and 1.20.2 fix incorrect results from the P-256 ScalarMult and ScalarBaseMult methods (P256Point in crypto/internal/nistec, reached through crypto/elliptic) when some unreduced scalars are used. The Go vulnerability database published it on 8 March as GO-2023-1621 (CVE-2023-24532) and says it does not impact crypto/ecdsa or crypto/ecdh.

    Bump the toolchain to 1.19.7 or 1.20.2. The exposure is code calling the crypto/elliptic P-256 ScalarMult or ScalarBaseMult directly, where a silently wrong result is worse than a crash.

Static site and web tooling

Sections
  • notable Hugo

    Hugo 0.111 adds page fragments, and ships broken — github.com

    Hugo 0.111.0, released 1 March 2023, introduced page fragments via a new .Fragments method for building tables of contents and detecting duplicate heading identifiers, redesigned the related content API into a single .Related method with a new fragments index type, and added a global page function giving templates access to the current page from nested contexts. The release shipped with a bug in that new global function and the project advised upgrading to 0.111.1.

    Pin 0.111.1 or later in CI, not 0.111.0. A same-week patch on a feature release is the case for pinning an exact Hugo version rather than a range, since the broken build is the one your pipeline would otherwise pick up.

Build on what the radar tracks

Integrations

How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.

Learn more

AI applications

Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.

Learn more

For developers

REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.

Learn more