AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile). Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise. | 9.8 | 100% | KEV |
| masshundreds of thousands of PHP sites/servers potentially exposed (order-of-magnitude estimate; unknown precise count) | |
| CVE-2018-15133 | Deserialization RCE in Laravel Framework via X-XSRF-TOKEN Header CVE-2018-15133 is a PHP deserialization flaw (CWE-502) in Laravel Framework versions through 5.5.40 and 5.6.x through 5.6.29: the decrypt method in Illuminate/Encryption/Encrypter.php passes the decrypted X-XSRF-TOKEN header value to unserialize, enabling PHP object injection via the PendingBroadcast gadget chain. A remote attacker triggers it by sending a crafted X-XSRF-TOKEN header, but only if they know the application's APP_KEY, which typically happens because the key was leaked (e.g., committed to public GitHub repositories) or reused across deployments. Successful exploitation yields remote code execution on the web server with high impact to confidentiality, integrity, and availability; in current campaigns the AndroxGh0st malware exploits this flaw to steal AWS, Azure, and Office 365 credentials and now also distributes Mozi botnet payloads. Any Laravel 5.5.x or 5.6.x application within the affected ranges is exposed, with practical risk concentrated on apps whose APP_KEY has been exposed or shared. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2024-01-16, EPSS puts the 30-day exploitation probability at about 77%, and public scanning has already identified 600+ Laravel apps with leaked APP_KEYs on GitHub. Do: Upgrade Laravel Framework to a release later than 5.6.29 (latest patched 5.6.x or a supported major version) per vendor guidance; CISA's KEV required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Because exploitation requires knowing the APP_KEY, audit and rotate the key, remove it from public repositories and exposed .env files, and hunt for AndroxGh0st activity (suspicious processes, outbound credential theft) on Laravel hosts. | 8.1 | 77% | KEV PoC |
| large≈10,000–100,000 internet-facing Laravel deployments plausibly affected (600+ apps already confirmed with leaked APP_KEYs on GitHub alone) | |
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 Apache HTTP Server contains a path traversal flaw (CWE-22) that lets crafted HTTP requests reach files outside directories configured via Alias-like directives. When files outside those aliased directories are not protected by the default 'require all denied' policy, attackers can read arbitrary files outside the intended root, and if CGI scripts are enabled the traversal can be escalated to remote code execution under the web server account. Anyone running an affected Apache HTTP Server release with such a configuration is exposed; the initial 2.4.50 patch was incomplete, so the flaw's full remediation is tracked under CVE-2021-42013. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns a ~100% probability of exploitation within 30 days (100th percentile). Do: Upgrade to Apache HTTP Server 2.4.51 or later; do not stop at 2.4.50, since its fix was incomplete (see CVE-2021-42013). As an interim mitigation, ensure directories referenced by Alias-like directives are covered by 'require all denied' and disable or restrict CGI (mod_cgi/mod_cgid) on traversable paths. Review access logs for traversal patterns such as /icons/../ and unexpected CGI invocations, and hunt for webshells or ransomware staging given the known ransomware use. | 9.8 | 100% | KEV ransomware PoC ×6 |
| masson the order of 100,000+ internet-exposed Apache servers |
Full article590 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 21, 2024Threat Intelligence / Vulnerability
Cybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data.
"It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs researcher Kashinath T Pattan said.
"Classified as an SMTP cracker, it exploits SMTP using various strategies such as credential exploitation, web shell deployment, and vulnerability scanning."
AndroxGh0st has been detected in the wild since at least 2022, with threat actors leveraging it to access Laravel environment files and steal credentials for various cloud-based applications like Amazon Web Services (AWS), SendGrid, and Twilio.
Attack chains involving the Python malware are known to exploit known security flaws in Apache HTTP Server, Laravel Framework, and PHPUnit to gain initial access and for privilege escalation and persistence.
Earlier this January, U.S. cybersecurity and intelligence agencies warned of attackers deploying the AndroxGh0st malware to create a botnet for "victim identification and exploitation in target networks."
"Androxgh0st first gains entry through a weakness in Apache, identified as CVE-2021-41773, allowing it to access vulnerable systems," Pattan explained.
"Following this, it exploits additional vulnerabilities, specifically CVE-2017-9841 and CVE-2018-15133, to execute code and establish persistent control, essentially taking over the targeted systems."
Androxgh0st is designed to exfiltrate sensitive data from various sources, including .env files, databases, and cloud credentials. This allows threat actors to deliver additional payloads to compromised systems.
Juniper Threat Labs said it has observed an uptick in activity related to the exploitation of CVE-2017-9841, making it essential that users move quickly to update their instances to the latest version.
A majority of the attack attempts targeting its honeypot infrastructure originated from the U.S., U.K., China, the Netherlands, Germany, Bulgaria, Kuwait, Russia, Estonia, and India, it added.
The development comes as the AhnLab Security Intelligence Center (ASEC) revealed that vulnerable WebLogic servers located in South Korea are being targeted by adversaries and used them as download servers to distribute a cryptocurrency miner called z0Miner and other tools like fast reverse proxy (FRP).
It also follows the discovery of a malicious campaign that infiltrates AWS instances to create over 6,000 EC2 instances within minutes and deploy a binary associated with a decentralized content delivery network (CDN) known as Meson Network.
The Singapore-based company, which aims to create the "world's largest bandwidth marketplace," works by allowing users to exchange their idle bandwidth and storage resources with Meson for tokens (i.e., rewards).
"This means miners will receive Meson tokens as a reward for providing servers to the Meson Network platform, and the reward will be calculated based on the amount of bandwidth and storage brought into the network," Sysdig said in a technical report published this month.
"It isn't all about mining cryptocurrency anymore. Services like Meson network want to leverage hard drive space and network bandwidth instead of CPU. While Meson may be a legitimate service, this shows that attackers are always on the lookout for new ways to make money."
With cloud environments increasingly becoming a lucrative target for threat actors, it is critical to keep software up to date and monitor for suspicious activity.
Threat intelligence firm Permiso has also released a tool called CloudGrappler, that's built on top of the foundations of cloudgrep and scans AWS and Azure for flagging malicious events related to well-known threat actors.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/03/androxgh0st-malware-targets-laravel.html