Malwarehigh
Web shell malware continues to evade many security tools
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2017-11317+1 related CVE | Unrestricted File Upload / RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 84% | KEVPoC ×2 | KEV |
| CVE-2018-15961 | Unrestricted File Upload Leading to RCE in Adobe ColdFusion | 9.8 | 100% | KEVPoC | KEV |
| CVE-2019-0604 | RCE in Microsoft SharePoint via Application Package Markup Validation Flaw | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2019-11580 | Unauthenticated RCE in Atlassian Crowd and Crowd Data Center | 9.8 | 95% | KEVRansomwarePoC | KEV |
| CVE-2019-18935 | Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2019-3396 | Server-Side Template Injection RCE in Atlassian Confluence Server and Data Center | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-3398 | Path Traversal Leading to RCE in Atlassian Confluence Server and Data Center | 8.8 | 97% | KEVPoC | KEV |
| CVE-2019-8394 | Authenticated Arbitrary File Upload in Zoho ManageEngine ServiceDesk Plus | 6.5 | 63% | KEVPoC | KEV |
| CVE-2019-9978 | Stored XSS in WordPress Social Warfare Plugin (CVE-2019-9978) Exploited in the Wild | 6.1 | 73% | KEVPoC ×5 | KEV |
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2020-10189 | Unauthenticated RCE in Zoho ManageEngine Desktop Central | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
2 min read at helpnetsecurity.com
Cyber attackers are increasingly leveraging web shell malware to get persistent access to compromised networks, the US National Security Agency and the Australian Signals Directorate warn. Web shells are malicious scripts that are uploaded to target systems (usually web servers) to enable attackers to control it remotely. In affect, they create a backdoor into the target system.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.