FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) | |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services |
Full article447 words · extracted from helpnetsecurity.com · click to collapse
The FritzFrog cryptomining botnet has new potential for growth: a recently analyzed variant of the bot is exploiting the Log4Shell (CVE-2021-44228) and PwnKit (CVE-2021-4034) vulnerabilities for lateral movement and privilege escalation.
The FritzFrog botnet
The FritzFrog botnet, initially identified in August 2020, is a peer-to-peer (rather than centrally-controlled) botnet powered by malware written in Golang.
It targets SSH servers by brute-forcing login credentials, and has managed to compromise thousands of them worldwide.
“Each compromised host becomes part of FritzFrog’s network — it communicates with its infected peers to share information, payloads, and configuration,” the Akamai Security Intelligence Group (SIG) noted.
The botnet’s ultimate goal is to use the compromised servers for covert crypto-mining.
New capabilities of the FritzFrog botnet
The bot malware is constantly updated with new and improved capabilities.
“[FritzFrog’s] P2P implementation was written from scratch, reminding us that the attackers are highly professional software developers,” the researchers pointed out.
The latest versions of the malware attempts to target all hosts in the internal network, either via SSH brute-forcing or by exploiting the infamous Log4Shell vulnerability.
“FritzFrog identifies potential Log4Shell targets by looking for HTTP servers over ports 8080, 8090, 8888 and 9000. To trigger the vulnerability, an attacker needs to force the vulnerable log4j application to log data containing a payload,” security researcher Ori David explained.
“FritzFrog sends the Log4Shell payload in numerous HTTP headers, hoping that at least one of them gets logged by the application. This brute force exploitation approach aims to be a generic Log4Shell exploit that can affect a wide variety of applications.”
Its creators are taking advantage of the fact that many organizations have patched Log4Shell on internet-facing applications, but have not yet done the same on internal assets.
FritzFrog also attempts to exploit PwnKit (CVE-2021-4034), a vulnerability in the PolKit Linux component, to rope in the pkexec binary – which runs with root privileges (even when executed by a weak user) – to ultimately load and execute FritzFrog’s binary.
And since PolKit comes pre-installed by default on most Linux distributions, many unpatched devices remain vulnerable, the researchers pointed out.
Finally, FritzFrog manages to evade detection by making sure not to drop files on the disk whenever possible.
Defensive measures
The researchers have provided a detection script enterprise defenders can use to check their SSH servers for indicators of a FritzFrog infection.
In general, though, admins should take care to secure SSH access to their servers with long and unique passwords and by enabling multi-factor authentication.
Network segmentation can foil FritzFrog’s (and other malware’s) lateral movement capabilities. “Software-based segmentation can be a relatively simple solution to spin up that has a long-lasting defensive impact,” the researchers concluded.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/02/01/botnet-log4shell-pwnkit/