US Government Urges Action to Mitigate Androxgh0st Malware Threat
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile). Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise. | 9.8 | 100% | KEV |
| masshundreds of thousands of PHP sites/servers potentially exposed (order-of-magnitude estimate; unknown precise count) | |
| CVE-2018-15133 | Deserialization RCE in Laravel Framework via X-XSRF-TOKEN Header CVE-2018-15133 is a PHP deserialization flaw (CWE-502) in Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29: the decrypt method in Illuminate/Encryption/Encrypter.php passes the decrypted X-XSRF-TOKEN header value to unserialize, enabling PHP object injection via the PendingBroadcast gadget chain. A remote attacker triggers it by sending a crafted X-XSRF-TOKEN header, but only if they know the application's APP_KEY, which typically happens because the key was leaked (e.g., committed to public GitHub repositories) or reused across deployments. Successful exploitation yields remote code execution on the web server with high impact to confidentiality, integrity, and availability; in current campaigns the AndroxGh0st malware exploits this flaw to steal AWS, Azure, and Office 365 credentials and now also distributes Mozi botnet payloads. Any Laravel 5.5.x or 5.6.x application within the affected ranges is exposed, with practical risk concentrated on apps whose APP_KEY has been exposed or shared. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-01-16, EPSS puts the 30-day exploitation probability at about 77%, and public scanning has already identified 600+ Laravel apps with leaked APP_KEYs on GitHub. Do: Upgrade Laravel Framework to a release later than 5.6.29 (latest patched 5.6.x or a supported major version) per vendor guidance; CISA's KEV required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Because exploitation requires knowing the APP_KEY, audit and rotate the key, remove it from public repositories and exposed .env files, and hunt for AndroxGh0st activity (suspicious processes, outbound credential theft) on Laravel hosts. | 8.1 | 77% | KEV PoC |
| large≈10,000–100,000 internet-facing Laravel deployments plausibly affected (600+ apps already confirmed with leaked APP_KEYs on GitHub alone) | |
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers |
Full article615 words · extracted from infosecurity-magazine.com · click to collapse
The US government has urged organizations to take action to protect against Androxgh0st malware, which is used by threat actors for victim identification and exploitation in target networks.
A joint advisory by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) dated January 16, 2024 warned that Androxgh0st supports numerous nefarious activities in breached networks.
The Python-scripted malware has been observed establishing a botnet for victim identification and exploitation. It primarily targets .env files containing confidential information, such as credentials, in high-profile applications like Amazon Web Services, MS Office 365 and SendGrid.
The advisory noted that Androxgh0st malware supports various functions capable of abusing the Simple Mail Transfer Protocol (SMTP), such as scanning and exploiting exposed credentials and application programming interfaces (APIs).
How Androxgh0st Attackers Compromise Targets
The FBI and CISA highlighted three specific vulnerabilities being exploited by threat actors in deploying Androxgh0st, which could lead to remote code execution:
- CVE-2017-9841: Attackers are remotely running hypertext preprocessor (PHP) code on fallible websites via PHPUnit. This subjects websites using the PHPUnit module that have internet-accessible folders to malicious HTTP POST requests. Once the threat actor remotely executes code, Androxgh0st is used to download malicious files to the system hosting the website.
- CVE-2018-15133: Remote code execution may occur in the Lavarel web application framework as a result of an unserialized call on a potentially untrusted X-XSRF-TOKEN value. This can allow threat actors to upload files to the website via remote access. The Androxgh0st malware is used to establish a botnet to identify websites using the Lavarel framework.
- CVE-2021-41773: Attackers have been observed scanning vulnerable web servers running Apache HTTP Server versions 2.4.49 or 2.4.50 to obtain credentials to access sensitive data. In this vulnerability, if these files are not protected by the “request all denied” configuration and Common Gateway Interface (CGI) scripts are enabled, this may allow for remote code execution.
These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities Catalog.
The advisory said the following requests are indicators of compromise associated with Androxgh0st activity:
- Incoming GET and POST requests to the URIs /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php and /.env
- Incoming POST requests with the following strings: [0x[]=androxgh0st] and ImmutableMultiDict([('0x[]', 'androxgh0st')])
How to Defend Against Androxgh0st Attacks
Organizations are advised to implement the following mitigations to protect themselves against the threat posed by Androxgh0st.
- Keep all operating systems, software and firmware up to date. The advisory urged organizations to ensure that Apache servers are not running versions 2.4.49 or 2.4.50.
- Verify that the default configuration for all URIs is to deny all requests unless there is a specific need for it to be accessible.
- Ensure that any live Laravel applications are not in “debug” or testing mode. This includes removing all cloud credentials from .env files and revoking them.
- Review any platforms or services that have credentials listed in the .env file for unauthorized access or use.
- Scan the server’s file system for unrecognized PHP files.
- Review outgoing GET requests to file hosting sites such as GitHub and pastebin.
- Validate your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework.
- Report any suspicious or criminal activity to your local FBI field office.
Commenting on the advisory, John A. Smith, CEO at Conversant Group noted that the malware primarily targets cloud environments, such as AWS, showing that this environment remains a big target for cybercriminals.
"Because AndroxGh0st is exploiting exposed .env files and unpatched vulnerabilities, it is well-advised to always inspect and monitor cloud environments regularly for any exposures and have a very aggressive policy for out-of-band patching. The cloud is most definitely not “set and forget”; it must be assertively secured and re-secured like any other part of the security estate," he advised.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/us-government-androxgh0st-malware/