Zerobot Botnet Devs Add New Functionality
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) Apache HTTP Server contains a path traversal flaw (CWE-22) that can lead to remote code execution; CVE-2021-42013 resolves an incomplete patch previously issued for CVE-2021-41773. The flaw is triggered when files outside directories mapped by Alias-like directives are not protected by the default 'require all denied' configuration, or when CGI scripts are enabled, allowing an attacker to traverse outside the intended directory roots. An attacker can read files outside the configured paths, and where CGI script execution is enabled, achieve remote code execution on the server. The affected product per CISA is Apache HTTP Server; the source data does not specify exact version ranges, so defenders should consult the vendor advisory for fixed releases. Exploitation is confirmed in the wild: the vulnerability was added to CISA KEV on 2021-11-03 with known ransomware use, EPSS estimates a 100% probability of exploitation within 30 days, and no public PoC is listed. Do: Apply the Apache HTTP Server update per vendor instructions immediately, since this is a CISA KEV item with known ransomware use and near-certain near-term exploitation. Until patched, ensure directories targeted by Alias-like directives are covered by 'require all denied' defaults and disable CGI script execution where it is not required. Review access logs for path traversal probes and confirm no replaced version retains the incomplete earlier patch. | 9.8 | 100% | KEV ransomware PoC ×6 |
| massorder of 100,000+ internet-exposed Apache HTTP Server instances at disclosure time | |
| CVE-2022-33891 | Command Injection in Apache Spark UI via ACL Impersonation (CVE-2022-33891) CVE-2022-33891 is an OS command injection flaw (CWE-78) in Apache Spark's HttpSecurityFilter, which handles access-control checks for the Spark UI. When ACLs are enabled via the spark.acls.enable configuration option, a remote party reaching the Spark UI can supply an arbitrary username that is accepted for impersonation, and that attacker-controlled input is ultimately used to build and execute a Unix shell command. A successful attacker gains arbitrary shell command execution as the operating-system user under which Spark is running, with the CVSS v3.1 vector (network vector, low complexity, low privileges, no user interaction, high C/I/A) rating this 8.8 High. It affects Apache Spark 3.0.3 and earlier, 3.1.1 through 3.1.2, and 3.2.0 through 3.2.1 — essentially deployments with ACLs enabled and a Spark UI reachable by untrusted users. Exploitation is confirmed in the wild: a public PoC exists, CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2023-03-07, and headlines report a Zerobot botnet variant spreading by exploiting Apache Spark, with EPSS at 93.1% (100th percentile). Do: Upgrade Apache Spark to a patched release per Apache's and CISA's vendor instructions, as the flaw is in the KEV Catalog with a required action of applying updates. As an interim mitigation, disable spark.acls.enable if ACLs are not required, and restrict network access to the Spark UI from untrusted networks or expose it only behind authentication at the network layer. Check Spark hosts for suspicious child processes or unexpected commands executed under the Spark service account, which would indicate successful exploitation. | 8.8 | 93% | KEV PoC |
| moderate≈ several thousand internet-exposed Spark UI instances (total Spark deployments across enterprises and managed cloud platforms are far larger) |
Full article355 words · extracted from infosecurity-magazine.com · click to collapse
A prolific botnet that spreads primarily through IoT and web application vulnerabilities has added new exploits and attack capabilities, Microsoft has warned.
Zerobot (aka ZeroStresser) is a Go-based botnet sold on the cybercrime underground via a malware-as-a-service model, which makes it relatively easy for its developers to update functionality regularly.
Mainly used for distributed denial of service (DDoS) attacks, the botnet is comprised of compromised connected devices such as firewall devices, routers and cameras, according to a new blog from the Microsoft Security Threat Intelligence team.
The tech giant recently observed Zerobot exploiting vulnerabilities in Apache (CVE-2021-42013) and Apache Spark (CVE-2022-33891) in order to compromise these devices.
That’s in addition to brute-forcing devices protected only by default or weak credentials.
“Upon gaining device access, Zerobot injects a malicious payload, which may be a generic script called zero.sh that downloads and attempts to execute Zerobot, or a script that downloads the Zerobot binary of a specific architecture,” Microsoft explained.
“The bash script that attempts to download different Zerobot binaries tries to identify the architecture by brute-force, attempting to download and execute binaries of various architectures until it succeeds, as IoT devices are based on many computer processing units (CPUs).”
To achieve persistence on Linux devices, Zerobot uses a combination of desktop entry, daemon and service methods, while on Windows it copies itself to the Startup folder with the file name “FireWall.exe,” Microsoft added.
Zerobot 1.1 also has seven new DDoS attack capabilities designed to make the botnet a more attractive prospect to would-be buyers.
“In almost every attack, the destination port is customizable, and threat actors who purchase the malware can modify the attack according to their target,” Microsoft explained.
To mitigate the threat from Zerobot and similar botnets, Microsoft urged firms to:
- Invest in security solutions with detection capabilities across multiple layers (i.e. email, apps, endpoints ,etc.)
- Adopt IoT-specific security tools to provide enhanced threat detection and response
- Make sure IoT devices are securely configured, up to date with firmware and use least privilege access
- Harden endpoints with application control and clean up any unused and stale executables on user devices
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/zerobot-botnet-devs-add-new/