Make-A-Wish website compromised to serve cryptojacking script
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data. Do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials. | 9.8 | 100% | KEV ransomware PoC ×4 |
| mass≈1,000,000 sites (Drupal's self-reported installed base at time of disclosure) | |
| CVE-2018-7602 | Drupal Core Remote Code Execution Vulnerability A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. NVD description · AI analysis pending | 9.8 | 99% | KEV ransomware PoC ×2 |
| — |
Full article339 words · extracted from helpnetsecurity.com · click to collapse
Visitors of the international website of the US-based non-profit Make-A-Wish Foundation have had their computing power misused to covertly mine cryptocurrency, Trustwave researchers have found.
The compromise
In-browser cryptomining is not illegal and many website owners prefer using as a money-making substitute for ads, but they usually inform the visitors about it.
In the majority of cases, though, covert cryptomining is a sign that cybercrooks have compromised the website, injected their own cryptomining script in it and are reaping the benefits. And this is exactly what happened to the Make-A-Wish Foundation website.
The cryptojacking CoinIMP script (check.js) injected into the website was being loaded from the drupalupdates.tk domain, which has been associated with a known campaign that has been exploiting a critical Drupal vulnerability (CVE-2018-7600, aka Drupalgeddon 2) to compromise websites since May 2018.
CoinIMP is a JavaScript miner that, similarly to the one offered by the infamous CoinHive service, mines Monero.
“What’s interesting about this particular campaign is that it uses different techniques to avoid static detections,” Trustwave SpiderLabs researcher Simon Kenin pointed out.
“It starts with changing the domain name that hosts the JavaScript miner, which is itself obfuscated. The WebSocket proxy also uses different domains and IPs which make blacklist solutions obsolete.”
Keeping websites safe
As the Foundation’s site runs on Drupal – one of the most popular CMSs today – it’s highly likely that the attackers took advantage of CVE-2018-7600 or CVE-2018-7602 (another remote code flaw) to gain access and inject the offending script.
“We made attempts to contact the Make-A-Wish organization, and while they didn’t respond to us, we’re happy to note that the injected script was removed from their site shortly after our outreach attempt,” Kenin noted.
Administrators of Drupal-based websites are urged to update their installations to the latest version available if they don’t want their website to suffer a similar fate.
If they failed to do so by now, they are advised to make sure their websites haven’t been compromised already with cryptojacking scripts (or worse!).
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2018/11/20/make-a-wish-cryptojacking/