New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-23752 | Improper Access Control in Joomla! Webservice Endpoints (CVE-2023-23752) Joomla! contains an improper access control flaw (CWE-284) in its webservice (REST API) endpoints: the API fails to enforce authentication, so unauthenticated remote attackers can access protected endpoints directly. It is triggered simply by sending crafted HTTP requests to the affected /api webservice routes without credentials, for example the route that exposes site application configuration. A successful request leaks sensitive configuration data, most notably database connection credentials, which attackers can use for further intrusion into the site's database and hosting environment. Any site running the affected Joomla! 4.x releases whose webservice endpoints are reachable is affected. Exploitation is confirmed in the wild — the flaw was added to CISA's KEV catalog on 2024-01-08 and carries a 99.8% EPSS probability of exploitation within 30 days — though no public proof-of-concept is known and ransomware use has not been confirmed. Do: Upgrade all Joomla! 4.x sites to 4.2.8 or later per the vendor's instructions, satisfying the CISA KEV required action. If upgrading is not immediately possible, restrict or block unauthenticated access to the /api/index.php webservice routes at the web server or WAF, treat any exposed database credentials as compromised (rotate them), and review logs for unauthenticated requests to /api endpoints. Organizations that cannot mitigate should discontinue use of the affected product per the CISA required action. | 5.3 | 100% | KEV |
| large≈300,000–500,000 Joomla! 4.x sites (hundreds of thousands), of which tens of thousands have the /api webservice routes directly exposed |
Full article411 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 14, 2023Vulnerability / Data Breach
A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific (APAC) region since at least September 2023.
"GambleForce uses a set of basic yet very effective techniques, including SQL injections and the exploitation of vulnerable website content management systems (CMS) to steal sensitive information, such as user credentials," Singapore-headquartered Group-IB said in a report shared with The Hacker News.
The group is estimated to have targeted 24 organizations in the gambling, government, retail, and travel sectors across Australia, Brazil, China, India, Indonesia, the Philippines, South Korea, and Thailand. Six of these attacks were successful.
The modus operandi of GambleForce is its exclusive reliance on open-source tools like dirsearch, sqlmap, tinyproxy, and redis-rogue-getshell at different stages of the attacks with the ultimate goal of exfiltrating sensitive information from compromised networks.
Also used by the threat actor is the legitimate post-exploitation framework known as Cobalt Strike. Interestingly, the version of the tool discovered on its attack infrastructure used commands in Chinese, although the group's origins are far from clear.
The attack chains entail the abuse of victims' public-facing applications of victims by exploiting SQL injections as well as the exploitation of CVE-2023-23752, a medium-severity flaw in Joomla CMS, to gain unauthorized access to a Brazilian company.
The SQL injections are accomplished by means of sqlmap, a popular open-source pentesting tool that's designed to automate the process of identifying database servers vulnerable to SQL injections and weaponizing them to take over the systems.
In such attacks, the threat actors inject malicious SQL code into a public facing web page of the targeted website, allowing them to get around default authentication protections and access sensitive data, such as hashed and plaintext user credentials.
It's currently not known how GambleForce leverages the stolen information. The cybersecurity firm said it also took down the adversary's command-and-control (C2) server and notified the identified victims.
"Web injections are among the oldest and most popular attack vectors," Nikita Rostovcev, senior threat analyst at Group-IB, said.
"And the reason being is that sometimes developers overlook the importance of input security and data validation. Insecure coding practices, incorrect database settings, and outdated software create a fertile environment for SQL injection attacks on web applications."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/12/new-hacker-group-gambleforce-tageting.html