Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes

CVE-2016-1555 is a critical (CVSS 9.8) unauthenticated command injection flaw (CWE-77) in the boardData102.php, boardData103.php, boardDataJP.php, boardDataNA.php, and boardDataWW.php management pages of seven NETGEAR wireless access point models. An attacker who can reach these web endpoints over the network can pass crafted input to the scripts and execute arbitrary operating-system commands on the access point, with no login, privilege, or user interaction required. Successful exploitation grants full control of the device, letting attackers use it as a foothold or conscript it into IoT botnets such as BotenaGo, which reportedly uses 33 exploits to target millions of IoT devices. Only the NETGEAR WN604 (firmware before 3.3.3) and the WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 (firmware before 3.5.5.0) are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), has a public proof-of-concept on Exploit-DB, and carries an EPSS score of 98.3%, so defenders should treat it as actively exploited in the wild.

Do: Upgrade the WN604 to firmware 3.3.3 or later and the WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 to firmware 3.5.5.0 or later, per NETGEAR's instructions. Until patched, do not expose these access points' web management interface to the internet and restrict administration to a trusted management VLAN or VPN; if current firmware is no longer obtainable for a given model, consider isolating or replacing the device. Review device and web-server logs for suspicious requests to the boardData*.php endpoints as a sign of attempted or successful exploitation.

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter.

LG N1A1 NAS firmware 3718.510 contains an OS command injection flaw (CWE-78) that allows an unauthenticated attacker to execute arbitrary commands on the device. The flaw is triggered over the network by sending crafted parameters in an HTTP POST request to the NAS web interface, requiring no credentials or user interaction. Successful exploitation gives the attacker remote code execution on the device, with full confidentiality, integrity, and availability impact per the critical 9.8 CVSS score. Only LG N1A1 NAS devices (specifically firmware 3718.510 per the disclosure) are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, carries a very high 89.4% EPSS probability of exploitation within 30 days, and a public proof-of-concept write-up is available.

Do: Apply updates per LG/vendor instructions as required by CISA's KEV listing; given the device's age, if no updated firmware is obtainable, replace or isolate the NAS. Immediately check whether the N1A1 web interface is exposed to the internet (port forwarding, UPnP) and restrict HTTP access to trusted networks or a VPN. Review device logs for suspicious HTTP POST requests and unexpected commands as evidence of compromise.

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.

Oracle BI Publisher (formerly XML Publisher), a component of Oracle Fusion Middleware, contains an unauthorized-access flaw in its BI Publisher Security subcomponent affecting versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access can trigger it by sending crafted HTTP requests to the BI Publisher service, with no credentials or user interaction required. Successful exploitation yields unauthorized read access to a subset of BI Publisher-accessible data and unauthorized update, insert or delete access to some of that data; because the CVSS scope is 'changed,' attacks may also significantly impact additional products that depend on the component. Any organization running the affected versions — including BI Publisher embedded in other Oracle Fusion Middleware deployments — is at risk. The flaw is confirmed exploited in the wild (CISA KEV, added 2022-03-25) and carries a very high EPSS (~92%), although no public proof-of-concept is known.

Do: Apply the Oracle-provided patch per vendor instructions (this 2019 CVE was fixed in the April 2019 Oracle Critical Patch Update), updating any installation on 11.1.1.9.0, 12.2.1.3.0 or 12.2.1.4.0. As an interim mitigation, restrict HTTP access to BI Publisher interfaces to trusted networks only. Given the CISA KEV listing, prioritize patching internet-facing instances and review logs for signs of unauthorized reads or writes to BI Publisher data.

Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

CVE-2020-25223 is an unauthenticated OS command injection (CWE-78) in the WebAdmin management interface of Sophos SG UTM appliances. A remote attacker can trigger it by sending a crafted request to the WebAdmin service containing a malicious SID parameter, which is passed to the underlying system without proper sanitization. Successful exploitation yields remote code execution with high impact on confidentiality, integrity and availability (CVSS 3.1 score of 9.8), effectively giving the attacker control of the firewall appliance. Any organization running SG UTM versions prior to v9.705 MR5, v9.607 MR7, or v9.511 MR11 is affected, particularly where the WebAdmin interface is reachable from the internet. The flaw is being actively exploited: it was added to CISA KEV on 2022-03-25, carries a 96.7% EPSS exploitation probability, and public PoC material exists; any ransomware association is currently unknown.

Do: Upgrade SG UTM to v9.705 MR5, v9.607 MR7, or v9.511 MR11 (or later) per vendor instructions, consistent with the CISA KEV required action. Until patched, restrict WebAdmin access to trusted management networks or VPN and ensure it is not directly exposed to the internet. Review WebAdmin access logs for anomalous or crafted SID parameter requests that may indicate prior exploitation, and note that ransomware-related use of this bug has not been confirmed.

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.

Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.

OpenSMTPD 6.6 contains a critical, unauthenticated remote code execution flaw (CWE-78) caused by an incorrect return value from input validation in smtp_mailaddr in smtp_session.c. A remote attacker triggers it during a normal SMTP session by supplying shell metacharacters in the MAIL FROM field; when OpenSMTPD runs with its default (uncommented) configuration, the unsanitized address is passed to a shell during mail delivery, executing attacker-supplied commands. Because the affected delivery path runs with root privileges, the attacker gains arbitrary command execution as root on the mail server. Affected deployments include OpenBSD 6.6, where OpenSMTPD is the default mail daemon, plus Debian, Fedora, and Ubuntu systems shipping OpenSMTPD 6.6. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), multiple public PoC exploits exist, and EPSS estimates a 99% probability of exploitation within 30 days.

Do: Apply vendor updates per CISA's required action: upgrade OpenSMTPD to the patched release (6.6.4p1 or later per vendor advisories) or install the OpenBSD 6.6 errata patch, and pull updated packages from Debian, Fedora, or Ubuntu. Verify your running version and whether the default (uncommented) smtpd.conf is in use; until patched, restrict access to the SMTP service from untrusted networks. Hunt for signs of compromise, such as unexpected commands or processes executed as root by smtpd.

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an API request. NOTE: this is NOT a Docker, Inc. product.

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Tenda AC11 routers running firmware through 02.03.01.104_CN contain a stack buffer overflow (CWE-787 out-of-bounds write) in the /goform/setmac web endpoint. An unauthenticated attacker can trigger it with a crafted HTTP POST request, overwriting stack memory and executing arbitrary code on the device. Successful exploitation yields full control of the router, enabling traffic interception, lateral movement into the attached home or small-office network, or use in botnets. All AC11 units on affected CN firmware are in scope; no other Tenda products are named in this advisory. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a very high EPSS score of 86.9%, and public proof-of-concept exploit material is available on GitHub.

Do: Upgrade AC11 firmware to a release newer than 02.03.01.104_CN per Tenda's instructions (no specific fixed version is provided in this data), as required by the CISA KEV catalog. Until patched, disable or restrict WAN-facing HTTP management and monitor for unexpected POST requests to /goform/setmac. Review whether the router is reachable from the internet, since unauthenticated network access is all an attacker needs.

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.