Radar · 2023-06
June 2023
Cl0p turns MOVEit into the year's defining data-theft campaign while Progress discloses two more SQL injections, a pre-authentication overflow reaches every FortiGate SSL-VPN appliance even with multi-factor authentication enabled, a double slash walks past Vite's dev-server file restriction and reads .env, Drupal 7 finally gets an end-of-life date and eSafety accepts an industry code that reaches Australian hosting providers directly.
What's on our radar this month: releases, advisories and standards across the stack we run and the platforms we integrate with.
AI platform and models
Sections- fyi OpenAI
Function calling arrives, and embeddings get 75 per cent cheaper — openai.com
On 13 June 2023 OpenAI added function calling to gpt-4-0613 and gpt-3.5-turbo-0613, letting developers describe functions through JSON Schema and receive structured JSON back — a more reliable structured-output mechanism in the API. New snapshots shipped alongside, including gpt-3.5-turbo-16k with four times the context at double the 4K price. Prices fell the same day: text-embedding-ada-002 dropped 75 per cent to US$0.0001 per thousand tokens and gpt-3.5-turbo input dropped 25 per cent. The older 0301 and 0314 snapshots went onto a deprecation path.
The embeddings price cut is the line that matters if you are costing vector search or retrieval, because it reset the economics of embedding an entire site's content rather than a curated subset — any 2023 costing done before 13 June is out by a factor of four. Function calling is also the mechanism to ask about when a supplier describes how a mid-2023 system calls external tools through the OpenAI API.
Update, July 2023: On 20 July 2023 OpenAI extended support for the original gpt-4 and gpt-3.5-turbo snapshots until at least 13 June 2024.
Security and edge
Sections- critical MOVEit
MOVEit becomes the year's defining data-theft campaign — thehackernews.com
CISA and the FBI published #StopRansomware advisory AA23-158A covering Cl0p's exploitation of CVE-2023-34362. Progress then disclosed two further unauthenticated SQL injection flaws in quick succession, CVE-2023-35036 and, about a week later on 15 June, CVE-2023-35708, with fixes across MOVEit Transfer 2020.1.10 (12.1.10) through 2023.0.3 (15.0.3). Evidence surfaced that Cl0p had been testing MOVEit exploitation as far back as July 2021. By mid-June Cl0p had named 27 organisations on its leak site including multiple US federal agencies, and Censys found roughly 31 per cent of exposed hosts in financial services.
The lesson for anyone fronting a managed file transfer product is that patch cadence alone was not enough — three unauthenticated SQL injections landed in three weeks, so a team that patched promptly each time still spent the month exposed. The control that held while the vendor iterated was at the edge: Progress urged customers to disable all HTTP and HTTPS traffic to MOVEit Transfer on ports 80 and 443 until a fix was in place. Worth generalising as a rule for any product in active mass exploitation.
- critical Fortinet
A pre-authentication overflow reaches every FortiGate SSL-VPN — bleepingcomputer.com
CVE-2023-27997 is a critical pre-authentication remote code execution flaw in the FortiOS / FortiGate SSL-VPN component, reachable before authentication on every appliance with SSL-VPN enabled and exploitable even where multi-factor authentication is configured. Fixed builds are FortiOS 6.0.17, 6.2.15, 6.4.13, 7.0.12 and 7.2.5. Fortinet said the flaw may have been exploited in a limited number of cases against government, manufacturing and critical infrastructure targets. Shodan showed over 500,000 internet-facing FortiGate firewalls at disclosure.
Multi-factor authentication not helping is the detail to carry, because it is the control most organisations would name if asked how their VPN is protected — a pre-auth flaw sits in front of it. An appliance still exposed in June with patching behind should have been treated as an emergency change and assumed compromised rather than assumed safe.
Standards and compliance
Sections- notable eSafety
eSafety accepts a hosting code that reaches Australian providers — itnews.com.au
On 1 June 2023 Commissioner Julie Inman Grant announced her final decision on the eight draft industry codes covering Class 1A and 1B material under the Online Safety Act 2021. Five were accepted for registration — Social Media Services, Internet Carriage Services, App Distribution Services, Hosting Services and Equipment. Two were refused, Designated Internet Services and Relevant Electronic Services, for not requiring adequate detection of that material in cloud storage and messaging. The Internet Search Engine Services code was reserved with four weeks to revise it in light of the generative-AI search announcements.
The Hosting Services code is the one that reaches Australian web and hosting providers directly, imposing obligations on entities hosting Australian end-user content — terms that prohibit Class 1 material, acting on reports and cooperating with eSafety. Any agency or enterprise running hosting, file upload, comments or other user-generated content gained an enforceable compliance surface from this decision. Confirm the registration and commencement dates against eSafety's own register before quoting them in an obligations document.
- notable ASD
The June 2023 Information Security Manual lands — cyber.gov.au
ASD published the June 2023 Information Security Manual in late June 2023.
IRAP-assessed providers and agencies holding an authorisation to operate have to reconcile each quarterly delta into their system security plans, so the change register rather than the manual is the document that generates work. Record which ISM release each assessment or SSP was written against — the question comes up in every re-assessment and is unpleasant to answer from memory.
- fyi DISR
Australia opens the question of whether to regulate AI — minister.industry.gov.au
On 1 June 2023 the Minister for Industry and Science released two documents — the Safe and responsible AI in Australia discussion paper from DISR, and the Rapid Response Report on Generative AI from the National Science and Technology Council. The paper mapped existing regulatory coverage, identified gaps, and asked whether Australia should rely on voluntary tools, frameworks and principles or move to enforceable laws and mandatory standards.
This is the starting point for Australian AI regulation and the reason to keep the reference. For web teams it is the moment adding a chatbot to a site became a governance question with a paper trail. The paper's choice between voluntary tools and enforceable laws is the one to watch, because whichever way it goes will shape what agencies ask of suppliers that build AI features.
Update, January 2024: The Government published its interim response to the consultation on 17 January 2024.
CMS and platforms
Sections- notable Drupal
Drupal 7 gets a final end-of-life date — drupal.org
PSA-2023-06-07, published 7 June 2023, set Drupal 7's end of life at 5 January 2025 and stated plainly that this is the final extension. Support was also reduced from 1 August 2023: the security team may publicly post moderately critical and less critical Drupal 7 issues where they are not mass-exploitable, Drupal 7 branches of unsupported contributed projects are no longer eligible for new maintainership, PHP below 5.6 is no longer supported, Windows-specific security fixes stop, and Drupal.org stopped building Drupal 7 distribution packages from Drush make files.
For the meaningful share of Australian government estates still on Drupal 7 in 2023, this converted an open-ended risk into a dated migration program with an eighteen-month runway — which is the difference between something a budget cycle can fund and something it cannot. Note the nearer date though: the support reduction on 1 August is two months out, not eighteen, and public disclosure of moderately critical issues changes the exposure profile well before the end-of-life date arrives.
- notable Drupal
Drupal 10.1 arrives with a December deadline attached to 10.0 — drupal.org
Released 22 June 2023, the first minor on the Drupal 10 line. It added permissions for managing custom blocks, a UI for viewing, reverting and deleting block revisions, a delete-any-file permission with operations fields in file views, a display-as-time-difference timestamp formatter, configurable code-block languages in CKEditor 5, and a consolidated settings page for Twig and cache configuration. Sites on Drupal 9.3.x must reach 9.4.4 or later before upgrading, and CKEditor 4 users should move to CKEditor 5 first.
This is the version most Australian Drupal 9 sites landed on during the 2023 upgrade wave, so it is the useful baseline when auditing what a site was migrated to. The date to diarise is the other one: security support for 10.0.x ended in December 2023, so a site that upgraded to Drupal 10 early and stopped had roughly six months before it was unsupported again.
Supply chain, CI/CD and IaC
Sections- critical PyPI
PyPI starts enforcing 2FA and builds malware response tooling — blog.pypi.org
Two dates. On 1 June 2023, accounts that already had two-factor authentication could no longer upload to upload.pypi.org with a password — API tokens or Trusted Publisher only. That is a step toward PyPI's requirement that every account enable 2FA by the end of 2023, not the mandate itself. On 22 June PyPI announced its Malware Reporting and Response project, funded by the Center for Security and Emerging Technology, building a malware reporting API, better admin triage tooling, trusted-reporter identification, response-time metrics and automated consensus-based takedowns. The justification was scale: the existing process was manual email with no deduplication, against an index of over 450,000 packages.
The upload enforcement is the one with teeth this month — it breaks a publishing pipeline rather than warning it. The malware project is the registry improving its own defences rather than something you configure, but it is worth tracking when arguing for dependency review budget.
- notable Terraform
Terraform 1.5 makes import plannable — hashicorp.com
Released 12 June 2023. The new top-level import block makes import a plannable operation — imports are declared in code, run through the normal plan and apply cycle, can be reviewed before state is touched, and can generate configuration automatically. The previous command imported one resource at a time, mutated state immediately with no preview, and required the resource block to be hand-written first. The new check block validates infrastructure functionally at the end of every plan and apply, referencing any resource, data source or module output, and emits warnings rather than failing the run.
Import blocks are the practical answer to adopting brownfield infrastructure, and check blocks are the right home for post-apply assertions that previously lived in bash — endpoint returns 200, certificate not near expiry. Both change what a good module example looks like, so provider and module authors have documentation to revisit.
- notable GitHub Actions
Actions declaring Node 12 are forced onto Node 16 — github.blog
Announced 13 June 2023 with enforcement from the following day: actions still declaring Node 12 began running on Node 16 by default, on the grounds that Node 12 had been out of support since April 2022. An escape hatch existed — setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION on the workflow or runner — but it was explicitly temporary, lasting only until GitHub removes Node 12 from the runner later in the northern summer.
Note the pattern rather than the individual change: GitHub moves actions off a Node runtime once Node itself stops supporting it. For anyone publishing their own actions this is a recurring tax, and the durable fix is a CI check on your action repositories that fails when action.yml declares a Node runtime older than current. Otherwise you rediscover this each time a Node release reaches end of life, usually from a broken consumer.
Languages, runtimes and frameworks
Sections- notable Node.js
Node ships ten CVEs, and four of them are outside the experimental models — nodejs.org
Released 20 June 2023 as v16.20.1, v18.16.1 and v20.3.1. Six of the ten concern the experimental permission and policy mechanisms: CVE-2023-30581 where mainModule.__proto__ bypasses the policy mechanism, CVE-2023-30584 a path-traversal bypass of the permission model, CVE-2023-30587 via the Inspector protocol, and further issues through fs.watchFile, fs.openAsBlob and OpenSSL engines. Four do not: CVE-2023-30585, privilege escalation through registry key manipulation in the Windows .msi installer; CVE-2023-30588, an X509Certificate denial of service; CVE-2023-30589, HTTP request smuggling via empty headers separated by a bare carriage return; and CVE-2023-30590, a DiffieHellman documentation mismatch.
Do not let the experimental-features framing set the priority. Request smuggling affects anything behind a proxy or CDN regardless of which Node features you enabled, and the .msi privilege escalation affects any Windows install. The batch also rolled up three OpenSSL updates and four c-ares advisories, so it is the release that clears a backlog as well as fixing its own list.
- notable Python
Python patches a URL-validation bypass, and 3.7 takes its last release — python.org
Python 3.10.12 landed on 6 June 2023, the same day as 3.7.17. The headline is CVE-2023-24329, where a URL prefixed with C0 control or space characters evades urllib.parse filtering. The release also bundles an OpenSSL upgrade in the installers covering six CVEs, a directory traversal in uu.decode, a directory index exposure in SimpleHTTPRequestHandler, file-execution hardening in trace, and tar extraction filters in tarfile and shutil.unpack_archive. Three weeks later, on 27 June, Python 3.7 reached end of life five years after its first release, and 3.7.17 is the final release that branch will get.
Using urllib.parse to enforce an allow-list or deny-list is a very common way to prevent SSRF, and until this release it was bypassable — treat any code doing that as having been ineffective rather than merely outdated. Anyone pinned to 3.7 should note that 3.7.17 is the last release that branch will ever get, so moving to a supported version is now the only route to later fixes.
- notable Go
Go's build step becomes the attack surface — pkg.go.dev
CVE-2023-29402, rated CVSS 9.8 by NVD: the go command may generate unexpected code at build time when using cgo, if you build an untrusted module whose directory names contain newline characters. Modules retrieved with
go getare not affected. Fixed in Go 1.19.10 and 1.20.5, released on 6 June 2023 with four security fixes to cmd/go and runtime.Upgrade the toolchain in your build images, not only in the runtime image. A CI system that runs
go buildover third-party or user-submitted modules is the thing at risk.
Static site and web tooling
Sections- notable Vite
A double slash walks past Vite's dev-server file restriction — github.com
CVE-2023-34092, published 1 June 2023, CVSS 7.5. Vite's server.fs.deny restriction failed to normalise paths containing multiple leading slashes, so a request using a double forward slash bypassed the restriction and could read protected files in the project root — .env and .env.local among them. Affected versions span vite below 2.9.16 and the 3.x, 4.0, 4.1, 4.2 and 4.3 lines, patched in 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3 and 4.3.9. Exposure requires the dev server to be bound to the network with --host.
Treat "it is only the dev server" as insufficient reassurance, because binding to the network is exactly what shared development environments, container setups and preview boxes do by default. The blast radius is wide: every Vite-based tool in the integrations catalogue inherits this, Astro included through its Vite 4.x dependency, along with SvelteKit, Nuxt and Remix. Check the transitive Vite version rather than the framework version.
Build on what the radar tracks
Integrations
How the CMSs, static site generators, and CI/CD tooling the radar tracks work with Quant.
Learn moreAI applications
Build RAG applications, chatbots, semantic search, and AI-powered features on Australian infrastructure.
Learn moreFor developers
REST APIs, GitHub Actions, and SDKs — deploy static sites or containers with full API access.
Learn more