Vulnerabilitycritical
New Mirai Variant Targets WebSVN Command Injection Vulnerability (CVE-2021
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-32305 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter | 9.8 | 87% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 75.119.143.229 | i variants and prevents infection. Indicators of Compromise 75.119.143[.]229 e6f20e73af6cc393dd139b32117a8681e15edfe61c157f3509d1e7401 |
| sha256 | 3cc3d7d32e8c85e0c594ca5cb2ecfbfba66ebbc1853bcb02c2a39fce9f238dbc | ae1f3d04d81a4a1dcd773c62d7e9a71cf7e3ae0c5a9f931353e86f11651 3cc3d7d32e8c85e0c594ca5cb2ecfbfba66ebbc1853bcb02c2a39fce9f238dbc dc7cf2212f09482ac034eb7e9f89ef0cec8bc9532d4fe2db8a880c2e1e4 |
| sha256 | 63c2cae1f3d04d81a4a1dcd773c62d7e9a71cf7e3ae0c5a9f931353e86f11651 | 9cdec637503472bc62d25348cefccc3de58244441547f3e2ed9b22c6c93 63c2cae1f3d04d81a4a1dcd773c62d7e9a71cf7e3ae0c5a9f931353e86f11651 3cc3d7d32e8c85e0c594ca5cb2ecfbfba66ebbc1853bcb02c2a39fce9f2 |
| sha256 | 7dc972346b9f82709bbcaabc30f126984468e60f2b085091471a9796ac4539b9 | 19dfeeb89507f9de162e7a727fa6024ca4b1d19cb5c44e53755200f2b66 7dc972346b9f82709bbcaabc30f126984468e60f2b085091471a9796ac4539b9 f4d851908e900d9201597f898cbb4420772a935901f25a77b31fc80e7cb |
| sha256 | 889cc2a3e06c5770ff23017aa067cd8a01b8b410e143e9da63542ead7ce484da | 1908e900d9201597f898cbb4420772a935901f25a77b31fc80e7cbc88b3 889cc2a3e06c5770ff23017aa067cd8a01b8b410e143e9da63542ead7ce484da Additional Resources Unit 42 research on Mirai |
| sha256 | 8cc43db17480170fac3213518fe18d52a5648ce04060561d6359d6c589a4321c | 2212f09482ac034eb7e9f89ef0cec8bc9532d4fe2db8a880c2e1e4ee8a2 8cc43db17480170fac3213518fe18d52a5648ce04060561d6359d6c589a4321c b09c85e75f65a9acc4693957caf4b4c56dd808c7d0d657c1bc9f74a1bd7 |
| sha256 | a55a2318e95dcfbe2d2082ee569642034ab05168fa0142ff1009798131b61f52 | 5e75f65a9acc4693957caf4b4c56dd808c7d0d657c1bc9f74a1bd772abe a55a2318e95dcfbe2d2082ee569642034ab05168fa0142ff1009798131b61f52 b43fd19dfeeb89507f9de162e7a727fa6024ca4b1d19cb5c44e53755200 |
| sha256 | b09c85e75f65a9acc4693957caf4b4c56dd808c7d0d657c1bc9f74a1bd772abe | db17480170fac3213518fe18d52a5648ce04060561d6359d6c589a4321c b09c85e75f65a9acc4693957caf4b4c56dd808c7d0d657c1bc9f74a1bd772abe a55a2318e95dcfbe2d2082ee569642034ab05168fa0142ff1009798131b |
| sha256 | b43fd19dfeeb89507f9de162e7a727fa6024ca4b1d19cb5c44e53755200f2b66 | 318e95dcfbe2d2082ee569642034ab05168fa0142ff1009798131b61f52 b43fd19dfeeb89507f9de162e7a727fa6024ca4b1d19cb5c44e53755200f2b66 7dc972346b9f82709bbcaabc30f126984468e60f2b085091471a9796ac4 |
| sha256 | c782f9cdec637503472bc62d25348cefccc3de58244441547f3e2ed9b22c6c93 | e73af6cc393dd139b32117a8681e15edfe61c157f3509d1e740184b3d5c c782f9cdec637503472bc62d25348cefccc3de58244441547f3e2ed9b22c6c93 63c2cae1f3d04d81a4a1dcd773c62d7e9a71cf7e3ae0c5a9f931353e86f |
| sha256 | dc7cf2212f09482ac034eb7e9f89ef0cec8bc9532d4fe2db8a880c2e1e4ee8a2 | 7d32e8c85e0c594ca5cb2ecfbfba66ebbc1853bcb02c2a39fce9f238dbc dc7cf2212f09482ac034eb7e9f89ef0cec8bc9532d4fe2db8a880c2e1e4ee8a2 8cc43db17480170fac3213518fe18d52a5648ce04060561d6359d6c589a |
| sha256 | e6f20e73af6cc393dd139b32117a8681e15edfe61c157f3509d1e740184b3d5c | events infection. Indicators of Compromise 75.119.143[.]229 e6f20e73af6cc393dd139b32117a8681e15edfe61c157f3509d1e740184b3d5c c782f9cdec637503472bc62d25348cefccc3de58244441547f3e2ed9b22 |
| sha256 | f4d851908e900d9201597f898cbb4420772a935901f25a77b31fc80e7cbc88b3 | 2346b9f82709bbcaabc30f126984468e60f2b085091471a9796ac4539b9 f4d851908e900d9201597f898cbb4420772a935901f25a77b31fc80e7cbc88b3 889cc2a3e06c5770ff23017aa067cd8a01b8b410e143e9da63542ead7ce |
From the original article
4 min read at unit42.paloaltonetworks.com
We have observed exploits in the wild for a recently disclosed command injection vulnerability affecting WebSVN, an open-source web application for browsing source code. The critical command injection vulnerability was discovered and patched in May 2021. A proof of concept was released and within a week, on June 26, 2021, attackers exploited the vulnerability to deploy variants of the Mirai DDoS malware.
By Brock Mammen, Haozhe Zhang · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.