Network Attack Trends: February
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21315 | Command Injection in systeminformation npm Package (CVE-2021-21315) The systeminformation npm package, a widely used Node.js library for retrieving hardware, system, and OS details, contains a command injection flaw (CWE-78) in versions before 5.3.1. The flaw is triggered when untrusted, user-controlled parameters are passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing injected commands to be executed by the underlying operating system. A successful attacker gains the ability to run arbitrary commands with the privileges of the Node.js process on the affected host, potentially enabling further compromise. Any application or service built on the npm package that forwards attacker-influenced input into these functions is affected, including deployments where the library is bundled into other products (e.g., Apache Cordova applications per the CPE data). The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-01-18, indicating exploitation in the wild, and its EPSS score of 90.7% places it in the top percentile for near-term exploitation probability. Do: Upgrade the systeminformation npm package to version 5.3.1 or later wherever it appears in your Node.js dependency trees. If upgrading is not immediately possible, sanitize all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), accepting only plain strings and rejecting arrays. Audit internet-facing Node.js applications (including any Cordova-packaged deployments) for use of these functions and confirm they are patched, per the CISA KEV required action. | 7.8 | 91% | KEV |
| mass>1,000,000 potential installations (npm package consistently records on the order of a million-plus weekly downloads); actual exploitable deployments are fewer… | |
| CVE-2021-21975 | SSRF in VMware vRealize Operations Manager API Enables Admin Credential Theft CVE-2021-21975 is a server-side request forgery (CWE-918) in the vRealize Operations Manager API affecting versions prior to 8.4. A malicious actor with network access to the vRealize Operations Manager API endpoint can trigger the flaw without authentication or user interaction, causing the server to make attacker-influenced requests. Successful abuse lets the attacker steal administrative credentials for vRealize Operations Manager; a public proof-of-concept additionally demonstrates chaining the SSRF into code execution. Organizations running vRealize Operations Manager on-premises, including VMware Cloud Foundation and vRealize Suite Lifecycle Manager deployments that include it, are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18) with known ransomware use and carries a very high EPSS score of 78.3%, indicating active, widespread exploitation. Do: Upgrade vRealize Operations Manager to version 8.4 or later (or apply the update in the bundled Cloud Foundation / vRealize Suite Lifecycle Manager releases per VMware's advisory instructions), as required by CISA's KEV listing. Restrict network access to the vRealize Operations Manager API to trusted management networks until patched, and review logs for signs of SSRF-driven requests or unauthorized use of stolen administrative credentials, given the known ransomware exploitation. | 7.5 | 78% | KEV ransomware PoC |
| largetens of thousands of enterprise deployments (thousands of instances exposed to the internet) | |
| CVE-2021-22986 | Unauthenticated RCE in F5 BIG-IP and BIG-IQ iControl REST F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability (CWE-863, improper authorization check) in the iControl REST interface. An unauthenticated attacker with network access to the REST endpoint can send crafted requests to execute arbitrary system commands, create or delete files, and disable services on the appliance or virtual instance. Successful exploitation effectively gives the attacker command-level control of the underlying F5 system, which is sufficient for account creation, persistence, lateral movement, and ransomware staging. Any organization running affected BIG-IP or BIG-IQ releases is exposed, particularly where the management interface or iControl REST is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, EPSS places the 30-day exploitation probability at 99.9% (top percentile), though no public PoC is cataloged. Do: Upgrade BIG-IP and BIG-IQ to the fixed releases identified in F5's advisory (K03051234) on an urgent basis, since exploitation is in the wild and ransomware actors use this flaw. Until patched, restrict network access to the management interface and iControl REST to trusted administration networks. Because ransomware use is known, review affected devices for indicators of compromise such as unexpected commands, created or deleted files, and disabled services. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed BIG-IP management interfaces (public scan counts at disclosure), within a total installed base of hundreds of thousands… | |
| CVE-2021-22991 | Buffer Overflow in F5 BIG-IP Traffic Management Microkernel (TMM) CVE-2021-22991 is a buffer overflow (CWE-119) in the URI normalization routine of F5 BIG-IP's Traffic Management Microkernel (TMM), the core component that processes traffic for all BIG-IP modules. It is triggered when undisclosed requests sent to a virtual server are incorrectly handled by TMM, causing a buffer overflow that typically results in a denial-of-service; in certain situations it may theoretically allow bypass of URL-based access controls or remote code execution. An unauthenticated, remote attacker (AV:N/PR:N/UI:N, CVSS 9.8) can reach the flaw simply by sending crafted requests to an affected virtual server. Organizations running BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, or 12.1.x prior to the fixed releases are affected, including all listed BIG-IP modules (LTM, DNS, ASM, APM, AFM, AWAF, and others); versions past End of Software Development are not evaluated. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-01-18, and EPSS places it in the 99th percentile (61.1% chance of exploitation within 30 days), though no public PoC is known. Do: Upgrade affected BIG-IP systems to 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, or 12.1.5.3 (or later) as applicable, per the vendor's instructions, as this is a CISA KEV requirement. Audit virtual servers exposed to untrusted traffic, since crafted requests to a virtual server are the trigger, and note that any BIG-IP modules on End-of-Software-Development branches are not evaluated and should be migrated. Because impact can include traffic-handling DoS and, in some situations, URL-based access control bypass or RCE, treat internet-facing BIG-IP appliances as priority targets for patching. | 9.8 | 61% | KEV |
| largetens of thousands of internet-exposed BIG-IP appliances (public scans show on the order of tens of thousands of exposed devices; total installed base is likely… | |
| CVE-2021-25298 | Authenticated OS Command Injection in Nagios XI 5.7.5 Cloud-VM Config Wizard CVE-2021-25298 is an OS command injection flaw (CWE-78) in Nagios XI version xi-5.7.5, located in /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. Because user-controlled input is not properly sanitized before being passed to the operating system, an authenticated user with low privileges can trigger the flaw with a single crafted HTTP request to the cloud-vm configuration wizard. Successful exploitation results in arbitrary OS command execution on the Nagios XI server, giving the attacker code execution on the monitoring host with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8). Any organization running Nagios XI 5.7.5 is affected, especially deployments whose web interface is reachable by untrusted or low-privileged users. The flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-01-18), has multiple public PoC exploits and a Metasploit module, and EPSS estimates a 75.1% probability of exploitation within 30 days. Do: Apply the vendor's update per CISA KEV required action by upgrading Nagios XI from 5.7.5 to a patched release (a version newer than 5.7.5) as soon as possible; as an interim mitigation, restrict access to the Nagios XI web interface, require strong authentication, and disable or remove the cloud-vm configuration wizard if it is unused. Hunt for compromise by reviewing logs for unexpected OS commands spawned by the Nagios XI web process via the cloud-vm wizard endpoint and for anomalous outbound connections from monitoring servers. | 8.8 | 75% | KEV PoC ×4 |
| moderateplausibly in the tens of thousands of Nagios XI deployments worldwide, with thousands of instances observed exposed on the public internet (order-of-magnitude… |
Full article2,184 words · extracted from unit42.paloaltonetworks.com · click to collapse
Executive Summary
Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We then draw conclusions about the most commonly exploited vulnerabilities the attackers are using, as well as the severity, category and origin of each attack.
Network Attack Trends February-April 2021: Analysis of the Latest Published Vulnerabilities
From February-April 2021, a total of 4,969 new Common Vulnerabilities and Exposures (CVE) numbers were registered. To better understand the potential impact they could have on network security, we collected as many details as possible for each CVE. In the following sections, we provide our observations based on the severity, affected products and vulnerability categories.
How Severe Are the Latest Vulnerabilities?
To estimate the potential impact of vulnerabilities, we consider their severity and examine any reliable proofs-of-concept (POCs) that are available. Some of the public sources we use to find POCs include Exploit-DB, GitHub, and Metasploit. Distribution for the 3,849 CVEs that have an assigned severity score of medium or higher can be seen in the following table:
| Severity | Count | Ratio | POC Availability |
| Critical | 598 | 15.5% | 9.4% |
| High | 1659 | 43.1% | 8.1% |
| Medium | 1592 | 41.4% | 7.0% |
Table 1. Severity distribution for CVEs registered in February-April 2021.
Vulnerabilities classified as critical are the least common, but they are also more likely to have POCs available. The data suggests that there is a correlation between the availability of a POC and the severity of a vulnerability. This could be influenced by the amount of attention a vulnerability receives when it is more severe, as it is more interesting to both security researchers and attackers. Palo Alto Networks continues to leverage the aforementioned threat intelligence information to provide protections for our customers.
Vulnerability Category Distribution
The type of vulnerability is also crucial to understanding its consequences. Out of the 4,327 newly published CVEs that were analyzed, only 27.3% are classified as local vulnerabilities, requiring prior access to a compromised system, while the remaining 72.7% are remote vulnerabilities, which can be exploited over a network. The most common types are shown below:
| Ranking | Vulnerability Type |
| 1 | Cross-Site Scripting |
| 2 | Denial-of-Service |
| 3 | Information Disclosure |
| 4 | Buffer Overflow |
| 5 | Privilege Escalation |
| 6 | Code Execution |
| 7 | Command Injection |
| 8 | SQL Injection |
| 9 | Out-of-Bounds Read |
| 10 | Memory Corruption |
Table 2. Vulnerability category ranking for CVEs registered in February-April 2021.
As web applications are one of the most popular types of software, it's understandable that cross-site scripting is the top-ranking type of vulnerability. Denial-of-service vulnerabilities are also abundant, possibly due to how difficult it can be to prevent them. However, they are usually less severe and not as valuable to attackers.
Network Attack Trends February-April 2021: Analysis of the Latest Exploits in the Wild
Data Collection
By leveraging Palo Alto Networks Next-Generation Firewalls as sensors on the perimeter, Unit 42 researchers have been able to isolate malicious activities from benign traffic from February-April 2021. We have analyzed more than 10 million sessions in total for this quarter. The malicious traffic is then further processed based on metrics such as IP addresses, port numbers and timestamps. This ensures the uniqueness of each attack session and thus eliminates potential data skews. The researchers then correlate the refined data with other attributes to infer attack trends over time and get a picture of the threat landscape.
How Severe Were the Attacks Exploited in the Wild?
Out of 10.6 million verified attack sessions observed, network traffic triggers and signatures categorized as informational and low severity are used to detect scanning and brute-forcing attempts. Therefore, we consider exploitable vulnerabilities with a severity ranking of medium and above (based on the CVSS v3 Score) as a verified attack.
Table 3 shows the session count and ratio of attacks grouped by the severity of each vulnerability.
| Severity | Session Count | Ratio |
| Critical | 2,602,996 | 21.1% |
| High | 6,611,114 | 62.3% |
| Medium | 1,772,091 | 16.7% |
Table 3. Attack severity distribution ratio in February-April 2021.
Exploitation of vulnerabilities with high severity significantly increased to 62.3% of observed sessions compared to last quarter, when this category made up only 10.7%. This may indicate that attackers were less successful in acquiring or weaponizing critical vulnerabilities during this time frame, causing them to settle for less severe vulnerabilities.
When Did the Network Attacks Occur?
For this installment of our network attack trends analysis, we collected data from February to April 2021, and we discovered that the majority of attacks were ranked with high severity. Attackers also made frequent use of newer vulnerabilities disclosed within the past year, as well as vulnerabilities exploited in the wild from 2017-19. This highlights the importance of updating security products and applying software patches as soon as they become available to provide protection against the most recently discovered vulnerabilities.
Latest Attacks: Exploits in the Wild
Out of all the attacks observed during this time period, the following exploits stood out due to their ease of exploitation, POC availability and severity. We have provided snippets that show how attackers used open source tools to compromise the different targets. We provide snippets of these exploits captured in our monitoring system below.
CVE-2021-25296, CVE-2021-25297 and CVE-2021-25298
There is an improper sanitization in multiple Nagios XI PHP files, such as windowswmi.inc.php, switch.inc.php, and cloud-vm.inc.php. An attacker can submit a crafted request that the software does not properly sanitize. We have published a blog that demonstrates how this specific attack can be used for cryptojacking. Figure 6 reveals the exploit.
A server-side request forgery (SSRF) vulnerability is present in VMware vRealize Operations Manager's API. An attacker can potentially steal administrative credentials or can send crafted requests to be processed with admin privileges. Figure 7 describes this particular attack.
Npm’s package system information is vulnerable to a command injection vulnerability. In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote commands. A sample exploit is shown in Figure 8.
The vulnerable parameters X-F5-Auth-Token and loginReference link of BIG-IP's iControl REST do not properly sanitize the user-supplied data, which an attacker can exploit to gain remote code execution (RCE). Figure 9 is an example of this exploit.
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, in which it does not properly handle incoming requests, leading to a bypassing of URL-based access controls. Figure 10 shows an unsuccessful exploitation attempt in the wild.
An RCE vulnerability in Microsoft Exchange Server’s X-BEResource HTTP is present in ProxyRequestHandler class. An attacker can exploit this vulnerability by sending a crafted request to a vulnerable Exchange Server. Figure 11 reveals the exploit.
In this information disclosure vulnerability, the administrator password can be disclosed by an unauthenticated user by visiting a unique URL. This vulnerability was first published in September 2020, and we started seeing triggers in our system in May 2021. A sample captured in our system is shown in Figure 12.
Inspur ClusterEngine 4.0 has an RCE vulnerability that allows an attacker to send a malicious login packet to the control server. We started seeing hits for this vulnerability in our system in April 2021. The vulnerability was originally published in February 2021. A live attack capture is displayed in Figure 13.
A cross-site request forgery (CSRF) vulnerability in MAGMI was discovered in September 2020. Due to the lack of proper checks on CSRF tokens, an attacker can perform a CSRF attack. We have observed it in our system in June 2021. Figure 14 shows an example.
In December 2020, an RCE vulnerability was discovered in D-Link DSL-2888A devices, allowing an authenticated user to execute operating system (OS) commands by exploiting one of the CGI. Our system captured the attacks in April 2021. Figure 15 has more relevant details.
In late January 2021, a buffer overflow vulnerability was disclosed in D-Link DIR-825 R1 devices. This vulnerability can be leveraged to achieve pre-authentication RCE. It started appearing in our systems in mid-March 2021. A sample exploit is shown in Figure 16 for reference.
The Micro Focus Operation Bridge Reporter (OBR) product has an RCE vulnerability, which an attacker can exploit by sending a crafted request to the OBR server. This was first disclosed in February 2021, but we have seen triggers in our system lately. Figure 17 shows the exploit in the wild.
There exists an RCE vulnerability in NETGEAR’s JGS516PE devices, which an attacker can easily exploit by sending a malicious request. This was first disclosed in October 2020, and we have seen attacks daily since March 2021. Due to the ease of exploitation and abundant availability of NETGEAR devices on the internet, this vulnerability seems to be favored by attackers. More details in Figure 18 below.
Another RCE vulnerability was captured by our systems starting in March 2021. This one is related to 74CMS, in which an attacker can achieve the RCE by exploiting the assign_resume_tpl method. This vulnerability was disclosed in December 2020. Figure 19 shows a live attack captured in our system.
Genexis Platinum 4410 has an RCE vulnerability that allows an attacker to pass shell metacharacters and achieve arbitrary command execution. The CVE was first made public in April 2021, and we observed it in our system around the same time. Figure 20 describes this particular attack.
Oracle WebLogic Server reported an RCE vulnerability in October 2020 that allows an attacker to easily exploit a vulnerable method called getHandle and take over the server. A new POC has been released recently. We started seeing this new method of attack in our system in May 2021. Figure 21 contains the exploit in the wild.
Attack Category Distribution
Figure 22 shows the session-based attack category distribution. To learn more details about impact and prevalence, we classified each network traffic trigger by attack category. Code execution accounts for 45.6% of attacks, which is unsurprising, considering that attackers typically want to gain as much control as possible over the systems they target. When fully compromising a target isn't an option, attackers demonstrated interest in obtaining sensitive data through directory traversal and information disclosure attacks. While SQL injection and cross-site scripting are two of the most common types of web application vulnerabilities, they were the least commonly abused among our observations.
Where Did the Attacks Originate?
After identifying the region from which each network attack originated, we discovered that the largest number of them seem to originate from the United States, followed by Russia and China. However, we recognize that the attackers might leverage proxy servers and VPNs located in those countries to hide their true physical locations.
Conclusion
Our data show that attackers prioritize exploits that are both severe and reliable, showing a preference for high-impact, low-effort attacks. The vulnerabilities published in February-April 2021 indicate that web applications remain popular and that critical vulnerabilities are more likely to have POCs publicly available. This emphasizes the need for organizations to promptly patch their systems and implement security best practices – attackers will make a concerted effort to expand their arsenal of exploits whenever possible.
While cybercriminals will never cease their malicious activities, Palo Alto Networks customers are fully protected from the attacks discussed here by Next-Generation Firewalls. Additional mitigations include:
- Run a Best Practice Assessment to identify where your configuration could be altered to improve your security posture.
- Continuously update your Next-Generation Firewalls with the latest Palo Alto Networks Threat Prevention content (e.g versions 8416 and above).
Additional Resources
Text extracted automatically; images, tables and formatting may be missing. Original: https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/