The Satan Ransomware adds new exploits to its arsenal

Red Hat JBoss Enterprise Application Platform's JMX-Console web application enforces its access-control checks only for the HTTP GET and POST methods, leaving requests sent with other HTTP verbs unauthenticated. A remote attacker can reach the console's GET handler by submitting the same request with a different method (e.g., HEAD), bypassing the configured authentication and access controls entirely. Once past the access control, the attacker can interact with the JMX console's management interfaces, a foothold that on many deployments can be escalated toward broader compromise of the JBoss server. Any organization running Red Hat JBoss (JBoss AS / JBoss EAP) where the JMX-Console is reachable, whether internally or exposed to the internet, is affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25) with known ransomware use, and EPSS assigns a 79.4% probability of exploitation within 30 days, so active exploitation should be assumed.

Do: Apply updates per Red Hat's vendor instructions, as required by CISA's KEV catalog. Until patched, restrict network access to the JMX-Console and block HTTP methods other than GET and POST (e.g., at a reverse proxy or in the application's security constraints) so the access-control check cannot be bypassed with verbs like HEAD, and review logs for requests to /jmx-console using unusual methods. Treat this flaw as actively exploited given its KEV listing with known ransomware use.

The Groovy scripting engine used by Elasticsearch for dynamic scripts (script fields, script-based sorting and queries) fails to properly confine user-supplied Groovy code, allowing a crafted script to escape the sandbox (CWE-284, improper access control) and invoke Java APIs such as Runtime to run arbitrary shell commands on the server. It is triggered remotely when an attacker who can reach the Elasticsearch HTTP API submits a malicious dynamic script (e.g., via the _search endpoint) on instances with dynamic scripting enabled. A successful attacker gains arbitrary command execution on the host running Elasticsearch, which can lead to full server compromise and follow-on activity such as malware or ransomware deployment. Affected deployments are Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 (per public advisory records; the CISA source data lists no explicit version range), with fixes shipped in 1.3.8 and 1.4.3. The flaw is confirmed exploited in the wild — CISA added it to the KEV catalog on 2022-03-25 with ransomware use unknown — and EPSS ranks it in the 100th percentile (99.9% probability of exploitation within 30 days), though no public PoC is listed in the source data.

Do: Upgrade Elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later, consistent with CISA's required action to apply updates per vendor instructions; as an interim mitigation, disable dynamic Groovy scripting (script.dynamic: false) and restrict port 9200 to trusted networks. Inventory internet-exposed instances (Shodan/Censys on port 9200), verify installed versions via the cluster's root endpoint, and hunt for signs of command execution such as unexpected processes, new cron/systemd entries, or outbound connections from Elasticsearch hosts.

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

Apache Tomcat 7.0.0 through 7.0.79 running on Windows with HTTP PUT enabled on the Default servlet (the readonly initialisation parameter set to false, which is not the default configuration) allows an unauthenticated attacker to upload a JSP file via a specially crafted PUT request (CWE-434), bypassing the extension check (e.g. via trailing-slash or case variations). The uploaded JSP can then be requested, and any code it contains is executed in the Tomcat server context, giving the attacker unauthenticated remote code execution. Only Tomcat 7 deployments on Windows with PUTs enabled are directly affected; because bundled Tomcat is also shipped in products from Red Hat (JBoss Enterprise Web Server, RHEL variants) and NetApp, those vendors issued advisories as well. This flaw is closely related to CVE-2017-12617, which was reported and patched around the same time. Exploitation is confirmed in the wild: it was added to CISA KEV on 2022-03-25 with known ransomware use, has two public proof-of-concept references, and EPSS assigns a 99.6% probability of exploitation within 30 days.

Do: Upgrade Tomcat beyond the affected 7.0.0–7.0.79 range per vendor instructions (Apache Tomcat directly, or via Red Hat JBoss Enterprise Web Server/RHEL and NetApp bundled-product advisories), prioritizing internet-facing Windows servers since the issue is KEV-listed with known ransomware use. If patching must be delayed, ensure the Default servlet readonly parameter remains at its default (true) to disable PUT, or block PUT requests at a reverse proxy/WAF on Windows Tomcat hosts. Also check affected Windows hosts for unexpectedly uploaded .jsp files and review access logs for PUT requests that created JSPs, as indicators of compromise.

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

CVE-2018-1273 is a property binder flaw (CWE-94, improper neutralization of special elements leading to code injection) in Spring Data Commons, affecting versions 1.13.0 to 1.13.10, 2.0.0 to 2.0.5, and older unsupported releases. An unauthenticated remote attacker triggers it by sending specially crafted request parameters against Spring Data REST-backed HTTP resources or via Spring Data projection-based request payload binding. Successful exploitation yields remote code execution on the application host, reflected in the critical CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. Any application built on the affected library and exposing the vulnerable binding paths is at risk, including deployments of Spring Data REST, Apache Ignite, and Oracle Financial Services Crime and Compliance Management Studio that bundle the library. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-03-25 with known ransomware use, EPSS rates a 97% probability of exploitation within 30 days (100th percentile), and related threat reporting shows active attacks against Java-based services, although no public PoC is catalogued in the source data.

Do: Apply vendor updates per the CISA KEV required action: upgrade Spring Data Commons past the last-affected releases 1.13.10 and 2.0.5 (i.e., 1.13.11 or 2.0.6 and later) or to the latest supported release. Inventory internet-facing Java applications for Spring Data REST endpoints and projection-based payload binding, patch or restrict those paths, and review application logs for exploitation activity given the known ransomware use.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).