Beapy Cryptojacking campaign leverages EternalBlue exploit to spread

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

Apache Tomcat 7.0.0 through 7.0.79 running on Windows with HTTP PUT enabled on the Default servlet (the readonly initialisation parameter set to false, which is not the default configuration) allows an unauthenticated attacker to upload a JSP file via a specially crafted PUT request (CWE-434), bypassing the extension check (e.g. via trailing-slash or case variations). The uploaded JSP can then be requested, and any code it contains is executed in the Tomcat server context, giving the attacker unauthenticated remote code execution. Only Tomcat 7 deployments on Windows with PUTs enabled are directly affected; because bundled Tomcat is also shipped in products from Red Hat (JBoss Enterprise Web Server, RHEL variants) and NetApp, those vendors issued advisories as well. This flaw is closely related to CVE-2017-12617, which was reported and patched around the same time. Exploitation is confirmed in the wild: it was added to CISA KEV on 2022-03-25 with known ransomware use, has two public proof-of-concept references, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade Tomcat beyond the affected 7.0.0–7.0.79 range per vendor instructions (Apache Tomcat directly, or via Red Hat JBoss Enterprise Web Server/RHEL and NetApp bundled-product advisories), prioritizing internet-facing Windows servers since the issue is KEV-listed with known ransomware use. If patching must be delayed, ensure the Default servlet readonly parameter remains at its default (true) to disable PUT, or block PUT requests at a reverse proxy/WAF on Windows Tomcat hosts. Also check affected Windows hosts for unexpectedly uploaded .jsp files and review access logs for PUT requests that created JSPs, as indicators of compromise.

CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data.

Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise.