Linux servers under attack via latest Exim flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk. Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys. | 9.8 | 100% | KEV PoC ×5 |
| mass≈500,000+ internet-exposed Exim SMTP servers, with hundreds of thousands likely running vulnerable versions |
Full article398 words · extracted from helpnetsecurity.com · click to collapse
It didn’t take long for attackers to start exploiting the recently revealed Exim vulnerability (CVE-2019-10149).
Active campaigns
One security enthusiast detected exploitation attempts five days ago:
Just detected the first attempts to exploit recent #exim remote command execution (RCE) security flaw (CVE-2019-10149). Tries to downloads a script located at http://173.212.214.137/s (careful). If you run Exim, make sure it's up-to-date. @qualys pic.twitter.com/s7veGBcKWO
— Freddie Leeman (@freddieleeman) June 9, 2019
Amit Serper, Cybereason’s head of security research, warned on Thursday about attackers exploiting the flaw to gain permanent root access via SSH to target Linux servers.
“The campaign uses a private authentication key that is installed on the target machine for root authentication,” he noted.
“Once remote command execution is established, it deploys a port scanner to search for additional vulnerable servers to infect. It subsequently removes any existing coin miners on the target along with any defenses against coinminers before installing its own.”
They also install a portscanner that “looks for additional vulnerable servers on the Internet, connects to them, and infects them with the initial script.”
What to do?
Despite the flaw having been patched in February and the security community urging admins to upgrade Exim to v4.92 or implement the patches provided for older (outdated) releases (from v4.87 to v4.91), there are still many vulnerable servers out there.
Cybereason’s latest Shodan search puts the number at 3,68 million or so – though this is just the servers that run an older Exim version and some of them may have patches implemented. Nevertheless, there are definitely too many.
If you’re servers are still vulnerable, get patching!
Cybereason has also provided some indicators of compromise that you can use to check whether you’ve been hit and have promised more information as soon as they dig it up. (Keep in mind, though, that these IoCs are just for this specific campaign and your servers might have been targeted by other attackers.)
UPDATE (June 16, 2019, 7:40 a.m. PT):
Microsoft has confirmed that an active Linux worm leveraging CVE-2019-10149 is operating in the wild and has urged customers using Azure virtual machines (VMs) to update the operating systems running on them.
“As this vulnerability is being actively exploited by worm activity, MSRC urges customers to observe Azure security best practices and patterns and to patch or restrict network access to VMs running the affected versions of Exim,” the company noted.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/06/14/exploiting-cve-2019-10149/