New Cloud Attack Targets Crypto CDN Meson Ahead of Launch
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3129 | Unauthenticated RCE in Laravel Ignition error-page package (facade/ignition) Laravel Ignition, the default error-page package bundled with Laravel applications, uses file_get_contents() and file_put_contents() insecurely in its solution-execution feature, allowing unauthenticated remote attackers to read and write arbitrary files on the server. The flaw is triggered by sending a crafted, unauthenticated HTTP request to Ignition's execute-solution endpoint, which is reachable whenever the application runs with debug mode enabled. Attackers can chain the arbitrary file write to execute arbitrary code in the context of the web application, leading to server compromise and, per CISA, ransomware deployment. Any internet-facing Laravel application running a vulnerable version of the Ignition package with debug mode enabled is affected. The vulnerability is known to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with ransomware use confirmed, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade facade/ignition to 2.5.2 or later on all Laravel applications, or update to a current Laravel release that bundles the fixed package. Ensure production environments run with debug mode disabled and block or restrict the /_ignition/execute-solution endpoint from untrusted access as an interim mitigation. Given confirmed ransomware use, hunt for signs of compromise such as modified environment files, unexpected scheduled tasks, or webshells, and apply the CISA-required mitigations or discontinue use of the product if patching is not possible. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-facing Laravel apps with debug mode enabled, out of an installed base of hundreds of thousands of Laravel sites |
Full article392 words · extracted from infosecurity-magazine.com · click to collapse
A malicious campaign has been observed exploiting the blockchain-based Meson service for illicit gains ahead of the crypto token unlock planned for March 15.
The campaign, discovered by the Sysdig Threat Research Team (TRT), saw an attacker swiftly create 6000 Meson Network nodes using a compromised cloud account, setting off alarms for multiple AWS users associated with exposed services within Sysdig’s infrastructure.
The attacker’s modus operandi involved exploiting CVE-2021-3129 in a Laveral application and misconfigurations in WordPress to gain initial access to the cloud account.
Subsequently, they utilized automated reconnaissance techniques to identify and exploit compromised users’ privileges, spawning many EC2 instances across multiple regions. The malicious activity culminated in the execution of the meson_cdn binary, resulting in significant costs for the account owner.
“As a result of the attack, we estimate a cost of more than $2,000 per day for all the Meson network nodes created, even just using micro sizes. This isn’t counting the potential costs for public IP addresses, which could run as much as $22,000 a month for 6,000 nodes,” Sysdig wrote in an advisory published on Monday.
Interestingly, unlike traditional crypto-jacking incidents characterized by high CPU and memory usage, the Meson application exhibited relatively low resource consumption. The deviation is due to the inner workings of the Meson Network, a blockchain project striving to establish an efficient bandwidth marketplace on Web3.
Read more on Web3 cybersecurity: Cyber-Attacks Drain $1.84bn from Web3 in 2023
In the context of Meson, miners are rewarded with Meson tokens based on bandwidth and storage contributions to the network, highlighting the shift in attacker priorities towards resource-intensive operations rather than CPU-centric cryptomining.
“For Meson, the attacker is more interested in storage space and high bandwidth instead of high-performance CPUs. This can be achieved with a large number of small instances but with a good amount of storage,” reads the advisory.
According to Sysdig, the rise of the Meson network in the blockchain domain, particularly post-initial coin offerings (ICO), signals a new frontier for attackers seeking to exploit storage space and high bandwidth for financial gains.
“In order to prevent your resources from getting wrapped up in one of these attacks and having to shell out thousands of dollars for resource consumption, it is critical to keep your software up to date and monitor your environments for suspicious activity,” concludes the technical write-up.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cloud-attack-targets-crypto-cdn/