251 Amazon-Hosted IPs Used in Exploit Scan Targeting ColdFusion, Struts, and Elasticsearch

GNU Bash through version 4.3 improperly processes trailing strings that follow function definitions inside environment variable values, allowing injected commands to run (CWE-78, OS command injection); this flaw is widely known as 'Shellshock'. An attacker triggers it by supplying a crafted environment variable to any service that invokes Bash, most notably CGI web handlers but also SSH, DHCP clients, and other software that sets variables and spawns the shell. Successful exploitation yields arbitrary code execution with the privileges of the Bash process on the target host. Any Linux, Unix, or similar system running an unpatched Bash through 4.3 is affected, including web servers, appliances, and embedded devices that ship the shell. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-01-28) with a required action to apply vendor updates, and EPSS assigns it a 100% probability of exploitation within 30 days, so patching is urgent.

Do: Apply Bash updates per your OS vendor's instructions, as required by the CISA KEV listing, ensuring the installed shell is a patched build newer than the unpatched 4.3-era code. Prioritize internet-exposed systems that pass environment variables to Bash, especially CGI-based web servers, and audit embedded appliances and other Linux/Unix hosts that may have been missed by standard patching.

The Groovy scripting engine used by Elasticsearch for dynamic scripts (script fields, script-based sorting and queries) fails to properly confine user-supplied Groovy code, allowing a crafted script to escape the sandbox (CWE-284, improper access control) and invoke Java APIs such as Runtime to run arbitrary shell commands on the server. It is triggered remotely when an attacker who can reach the Elasticsearch HTTP API submits a malicious dynamic script (e.g., via the _search endpoint) on instances with dynamic scripting enabled. A successful attacker gains arbitrary command execution on the host running Elasticsearch, which can lead to full server compromise and follow-on activity such as malware or ransomware deployment. Affected deployments are Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 (per public advisory records; the CISA source data lists no explicit version range), with fixes shipped in 1.3.8 and 1.4.3. The flaw is confirmed exploited in the wild — CISA added it to the KEV catalog on 2022-03-25 with ransomware use unknown — and EPSS ranks it in the 100th percentile (99.9% probability of exploitation within 30 days), though no public PoC is listed in the source data.

Do: Upgrade Elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later, consistent with CISA's required action to apply updates per vendor instructions; as an interim mitigation, disable dynamic Groovy scripting (script.dynamic: false) and restrict port 9200 to trusted networks. Inventory internet-exposed instances (Shodan/Censys on port 9200), verify installed versions via the cluster's root endpoint, and hunt for signs of command execution such as unexpected processes, new cron/systemd entries, or outbound connections from Elasticsearch hosts.

CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data.

Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise.

Adobe ColdFusion contains an unrestricted file upload flaw (CWE-434) that allows an attacker to upload files of arbitrary type to the server without adequate authentication or validation. The flaw is triggered by sending crafted file-upload requests to vulnerable ColdFusion functionality; uploaded files can then be retrieved and executed (for example, a malicious JSP or webshell), escalating the upload into full remote code execution. Successful exploitation gives an attacker code execution in the context of the ColdFusion server on the host, which is sufficient to deploy webshells or ransomware and move laterally. Any organization running an unpatched ColdFusion server, particularly one exposed to the internet, is affected because the upload path requires no credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS probability of 100%, indicating active exploitation in the wild, although specific ransomware use is listed as unknown.

Do: Apply the Adobe ColdFusion security update for CVE-2018-15961 (APSB18-33) per vendor instructions. Inspect upload directories and web-accessible ColdFusion folders for unexpected scripts or webshells, and review access logs for suspicious upload activity. Restrict internet exposure of ColdFusion servers; as a KEV entry, patching by the CISA due date is mandatory for federal agencies.

Atlassian Confluence Server and Data Center contain an unauthenticated remote code execution flaw caused by improper neutralization of expression-language (OGNL) input (CWE-917): an attacker with network access to the application can submit a crafted request that is evaluated as an expression and executed by the server. Successful exploitation lets a remote, unauthenticated attacker run arbitrary code with the privileges of the Confluence process, without any credentials. All organizations running self-managed Confluence Server or Data Center are affected, particularly instances exposed to the internet; Confluence Cloud is not listed among the affected products. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-06-02 with ransomware use marked as known, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile). CVSS has not yet been scored in this data, but the KEV listing and known ransomware use make unpatched, internet-facing instances a top-priority patching target.

Do: Immediately upgrade to the patched Confluence release specified in Atlassian's 2022-06-02 security advisory, and until patched follow the CISA required action to block all internet traffic to and from affected instances. Because in-the-wild exploitation and ransomware use are confirmed, also hunt for compromise indicators on both patched and unpatched hosts, such as webshells, unexpected child processes of the Confluence service, and unusual outbound connections.