New variant of Linux Botnet WatchBog adds BlueKeep scanner

CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign.

Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise.

CVE-2018-1000861 is a critical flaw (CVSS 3.1: 9.8) in the Stapler web framework used by Jenkins, located in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java, where crafted URLs cause the framework to invoke Java object methods that were never intended to be reachable over HTTP (CWE-502, deserialization of untrusted data). By chaining these unintended method invocations, an unauthenticated remote attacker can achieve code execution on the affected Jenkins instance. All Jenkins releases up to and including 2.153 (weekly line) and 2.138.3 (LTS line) are affected, and Red Hat OpenShift Container Platform deployments that ship bundled Jenkins/Stapler components are also in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 98.3% probability of exploitation within 30 days, and related reporting documents hackers exploiting this Jenkins flaw, with coverage of the WatchBog cryptomining botnet known to target it. No public proof-of-concept exploit is catalogued and ransomware use is unknown, but the KEV listing alone confirms real-world exploitation.

Do: Upgrade Jenkins to a release newer than 2.153 (weekly) or newer than 2.138.3 (LTS), per vendor instructions (fixed releases are 2.154 / 2.138.4 or later), and apply Red Hat updates for OpenShift Container Platform images that bundle Jenkins. Until patched, keep Jenkins controllers off the open internet, restrict unauthenticated/anonymous access to the Jenkins UI, and review controller logs for crafted URLs that invoke unintended methods on Java objects. Because the flaw is in CISA KEV with a 98.3% EPSS score, treat patching as urgent and check internet-exposed controllers for signs of compromise such as cryptomining activity.

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.

Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.

CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk.

Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys.

Atlassian Jira Server and Data Center contain a server-side template injection (CWE-74) in the ContactAdministrators and SendBulkMail actions, rated critical at CVSS 9.8. The flaw is triggered by sending crafted, template-syntax input to these mail-related actions over the network; because the vulnerability requires no authentication or user interaction per the CVSS vector, any attacker who can reach the Jira web interface can trigger it. Successful exploitation yields unauthenticated remote code execution on the server hosting Jira, with high impact on confidentiality, integrity, and availability. Organizations running any Jira Server or Data Center release in the 4.4–7.6, 7.7–7.13, 8.0, 8.1, or 8.2 lines prior to the listed fixed versions are affected, and the exposure is concentrated among instances reachable from the internet. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-07 with a required action to apply vendor updates, and EPSS places it in the 100th percentile (~84.6% probability of exploitation within 30 days).

Do: Apply the vendor updates per Atlassian/CISA instructions — upgrade to Jira 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3 (or later) as applicable, since this is a KEV item with a required patching action. As an interim mitigation, disable the 'Allow users to contact administrators' option in Jira's General Configuration to close the ContactAdministrators path and restrict SendBulkMail access, and limit exposure of the Jira web interface to the internet. Review access logs for requests hitting ContactAdministrators/SendBulkMail endpoints containing template injection payloads and hunt for signs of post-exploitation code execution on affected servers.

CVE-2019-7238 is an incorrect access control flaw in Sonatype Nexus Repository Manager versions before 3.15.0 that is triggerable over the network by unauthenticated attackers with no user interaction, earning a critical CVSS 3.1 score of 9.8 with high impact on confidentiality, integrity, and availability. Any attacker who can reach a vulnerable instance can gain high-impact access to the repository server, consistent with full compromise of the system and the software artifacts it hosts and serves. All deployments running Nexus Repository Manager releases prior to 3.15.0 are affected, whether exposed to the internet or hosted internally as part of build and CI/CD pipelines. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities Catalog on 2021-12-10 (ransomware use unknown), EPSS assigns a 77.1% probability of exploitation within 30 days, no public PoC is known, and the related WatchBog Linux botnet headlines are consistent with the cryptomining campaigns that targeted Nexus Repository Manager deployments in this period.

Do: Upgrade all Nexus Repository Manager deployments to version 3.15.0 or later per Sonatype and CISA instructions, and inventory any 3.x instances still running older releases, prioritizing internet-facing ones. Restrict network access to the Nexus service to trusted networks and users, and check instances for signs of compromise such as unexpected cryptomining processes or outbound connections to Pastebin, consistent with the botnet campaigns referenced in related reporting.