Web shell malware continues to evade many security tools

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and in R2 releases before R2 2017 SP2 uses weak encryption for the RadAsyncUpload component, allowing unauthenticated remote attackers to forge upload parameters, upload arbitrary files to the web server, and ultimately execute arbitrary code. The flaw is triggered simply by sending crafted requests to the vulnerable upload handler over the network, with no authentication or user interaction required. Successful exploitation gives an attacker arbitrary file upload and remote code execution in the context of the ASP.NET application, which is typically hosted on IIS web servers. Any site or application built with Telerik UI for ASP.NET AJAX is affected, and the weakness is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11, and related reporting describes multiple hacking groups — including IIS/ASP.NET-focused APT actors — breaching a U.S. federal agency through it.

Do: Upgrade Telerik UI for ASP.NET AJAX to R1 2017 or R2 2017 SP2 (or later) per vendor instructions, and verify the deployed Telerik.Web.UI.dll version in each application's bin folder. Given active in-the-wild exploitation of IIS/ASP.NET applications, review affected web servers for unauthorized uploads and web shells and rotate ASP.NET machine keys used with RadAsyncUpload.

Adobe ColdFusion contains an unrestricted file upload flaw (CWE-434) that allows an attacker to upload files of arbitrary type to the server without adequate authentication or validation. The flaw is triggered by sending crafted file-upload requests to vulnerable ColdFusion functionality; uploaded files can then be retrieved and executed (for example, a malicious JSP or webshell), escalating the upload into full remote code execution. Successful exploitation gives an attacker code execution in the context of the ColdFusion server on the host, which is sufficient to deploy webshells or ransomware and move laterally. Any organization running an unpatched ColdFusion server, particularly one exposed to the internet, is affected because the upload path requires no credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS probability of 100%, indicating active exploitation in the wild, although specific ransomware use is listed as unknown.

Do: Apply the Adobe ColdFusion security update for CVE-2018-15961 (APSB18-33) per vendor instructions. Inspect upload directories and web-accessible ColdFusion folders for unexpected scripts or webshells, and review access logs for suspicious upload activity. Restrict internet exposure of ColdFusion servers; as a KEV entry, patching by the CISA due date is mandatory for federal agencies.

Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued.

Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied.

Atlassian accidentally shipped its pdkinstall development plugin enabled in release builds of Crowd and Crowd Data Center, so anyone who can send requests to the instance can install arbitrary plugins on it. An unauthenticated attacker sends crafted requests to a vulnerable Crowd server, uploads a malicious plugin, and gains remote code execution on the host. All releases from 2.1.0 through the 3.4.x line are affected until the 3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4 fixes, so essentially every Crowd deployment predating those patches is exposed, particularly enterprises using Crowd for centralized identity/SSO with the instance reachable over the network. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, a public PoC exploit is available, and EPSS assigns a 95.4% probability of exploitation within 30 days.

Do: Upgrade Crowd or Crowd Data Center to 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4 (or later) on the corresponding release line; where patching is delayed, disable the pdkinstall plugin in the administration console as an interim mitigation. Review installed plugins for unfamiliar entries and hunt for web shells or post-exploitation activity, since CISA notes ransomware use of this flaw.

CVE-2019-18935 is a .NET deserialization flaw (CWE-502) in the RadAsyncUpload function of Progress Telerik UI for ASP.NET AJAX through version 2019.3.1023. It is triggered when an attacker who knows the Telerik upload encryption keys — most commonly because the earlier flaws CVE-2017-11317 or CVE-2017-11357 exposed them, though keys can be obtained by other means — sends crafted serialized data to RadAsyncUpload, allowing remote code execution without authentication. Successful exploitation gives an attacker arbitrary code execution on the hosting IIS/ASP.NET web server, reflected in the critical 9.8 CVSS score. Any web application built with Telerik UI for ASP.NET AJAX at or below 2019.3.1023 is affected, unless 2019.3.1023 has the non-default hardening setting enabled (as of 2020.1.114 a default setting prevents the exploit). Exploitation is rampant in the wild: the flaw was added to CISA KEV on 2021-11-03 with known ransomware use, carries a 99.7% EPSS probability of exploitation, has multiple public exploits (Bishop Fox, RAU_crypto, noperator), and has been used by multiple threat groups — including ransomware and government-linked actors — to breach organizations including a U.S. federal agency.

Do: Upgrade to Progress Telerik UI for ASP.NET AJAX 2020.1.114 or later, where a default setting prevents exploitation (or, if staying on 2019.3.1023, enable the non-default hardening setting); per CISA KEV, apply updates per vendor instructions. Because exploitation requires the encryption keys to be known, also patch the older CVE-2017-11317/CVE-2017-11357 key-disclosure flaws or rotate the Telerik upload encryption keys. Check internet-facing IIS/ASP.NET applications for exposed RadAsyncUpload handlers and indicators of compromise, given known ransomware and federal-agency breaches.

CVE-2019-19781 is a path-traversal flaw (classified CWE-22, though CISA's description calls it unspecified) in Citrix ADC (formerly NetScaler ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances that lets an unauthenticated remote attacker traverse directories via crafted requests and execute arbitrary commands on the appliance, typically with root privileges. It is triggered by sending specially crafted directory-traversal requests (crafted URLs/requests to the appliance's management or VPN endpoints), which lets the attacker write files and run commands with no credentials. Successful exploitation yields arbitrary code execution on the appliance, enabling theft of VPN/ADC credentials, lateral movement into the corporate network, and installation of persistent backdoors. Any organization running affected ADC, Gateway, or SD-WAN WANOP firmware is affected, with internet-facing gateways used for remote access at the highest risk. Exploitation is confirmed in the wild: the vulnerability is on CISA's KEV (added 2021-11-03) with known ransomware use, EPSS assigns near-certain (100.0%) probability of exploitation within 30 days, and no public PoC is listed despite confirmed abuse.

Do: Upgrade Citrix ADC, Gateway, and SD-WAN WANOP appliances to the fixed firmware builds listed in Citrix advisory CTX267020; if patching cannot be done immediately, apply Citrix's published interim mitigation and restrict internet exposure to the appliance. Because exploitation grants root code execution and persistence, after patching hunt for indicators of compromise (unexpected nsroot account, modified system files, crontab/scheduled entries), kill all active and inactive sessions, and rotate appliance and VPN credentials. Prioritize internet-facing gateways and comply with CISA's required action to apply vendor updates.

Atlassian Confluence Server and Data Center contain a server-side template injection flaw (CWE-22) in which attacker-supplied template content is processed by the server, enabling path traversal and ultimately remote code execution. An attacker triggers it by submitting crafted template syntax in a request to a vulnerable instance, and can run arbitrary commands or code on the underlying server. Successful compromise could allow data theft, deployment of webshells, or ransomware; CISA notes known ransomware use of this vulnerability. Organizations running self-hosted Confluence Server or Data Center are affected, particularly instances exposed to the internet. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and EPSS assigns a 99.9% probability of exploitation, placing it in the top percentile.

Do: Apply updates per vendor instructions by upgrading Confluence Server and Data Center to Atlassian's fixed releases, and prioritize internet-facing instances. Until patched, restrict network exposure of Confluence and monitor for signs of compromise such as webshells, unexpected processes, or ransomware activity, since ransomware operators are known to exploit this flaw.

CVE-2019-3398 is a path traversal flaw (CWE-22) in the downloadallattachments resource of Atlassian Confluence Server and Data Center that allows arbitrary file writes. An attacker needs limited privileges: permission to add attachments to a page or blog, the ability to create a new space or personal space, or Admin permissions on a space; they can then write files to arbitrary filesystem locations, including paths that yield remote code execution. All Confluence Server/Data Center releases from 2.0.0 onward across the 6.6.x, 6.7.x–6.12.x, 6.13.x, 6.14.x, and 6.15.x lines are affected prior to the listed fixed versions. Because arbitrary file writes on a web application host are commonly used to plant web shells, this flaw aligns with the web-shell activity highlighted in recent NSA/ASD reporting. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and has a very high EPSS score (96.8%), with a public proof-of-concept available.

Do: Upgrade Confluence Server/Data Center to 6.6.13, 6.12.4, 6.13.4, 6.14.3, or 6.15.2 (or later) per the vendor's instructions, prioritizing internet-facing instances given the KEV listing and near-certain exploitation. In the meantime, restrict permissions to add attachments and create spaces/personal spaces to trusted users, and hunt for signs of compromise such as unexpected files or web shells in the Confluence webroot and other arbitrary-write locations.

CVE-2019-8394 is an unrestricted file upload flaw (CWE-434) in Zoho ManageEngine ServiceDesk Plus, located in the login page customization feature. A remote attacker with low-privilege authenticated access can abuse this feature to upload arbitrary files of any type, including JSP web shells, to the server. By planting a web shell, the attacker achieves high-integrity tampering of the system (per the CVSS vector) and, in practice, remote code execution on the ServiceDesk Plus host — a technique consistent with the web shell deployment campaigns highlighted in recent NSA/ASD guidance. All ServiceDesk Plus builds before 10.0 Build 10012 are affected. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2021-11-03, a public proof-of-concept is available (Exploit-DB 46413), and EPSS assigns a 63.3% probability of exploitation within 30 days.

Do: Upgrade ServiceDesk Plus to 10.0 Build 10012 or later per Zoho's vendor instructions. Because exploitation requires low-privilege credentials, review and rotate service/portal accounts and hunt for attacker-uploaded files or web shells in the application's web directories, especially files dropped through login page customization. Follow NSA/ASD web shell detection guidance and scan for suspicious JSP files and outbound connections if compromise is suspected.

CVE-2019-9978 is a stored cross-site scripting (CWE-79) flaw in the Social Warfare social-sharing plugin for WordPress: the plugin's debug routine at wp-admin/admin-post.php?swp_debug=load_options accepts an unauthenticated swp_url parameter and uses it to pull in attacker-controlled settings/content that is then persisted on the site. An attacker triggers the flaw by simply sending an unauthenticated request to admin-post.php with swp_debug=load_options and a crafted swp_url; the injected content later executes in the browsers of WordPress administrators when they view the affected dashboard or pages. Successful exploitation lets an attacker run arbitrary JavaScript in admin sessions, change plugin and site settings, and inject malicious scripts, redirects, or content into the site; public PoCs and the in-the-wild exploits were described as escalating to remote code execution. Any WordPress site running Social Warfare or Social Warfare Pro before version 3.5.3 is affected. The flaw was exploited as a zero-day in March 2019, is on CISA's KEV (added 2021-11-03) with a 72.9% EPSS (99th percentile), and related reporting indicates widespread active exploitation with follow-on web shell activity.

Do: Upgrade Social Warfare and Social Warfare Pro to version 3.5.3 or later immediately (apply updates per vendor instructions) and verify the installed version under Plugins in wp-admin. If updating is not possible right away, deactivate the plugin or block unauthenticated requests to admin-post.php that include the swp_debug parameter. Review plugin settings, posts, and pages for injected JavaScript, check administrator accounts for additions or changes, and hunt for web shells given reported follow-on deployments.

CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange Server caused by the validation key not being uniquely created at install time, leaving deployments with a predictable, shared key (CWE-287, improper authentication). A remote attacker who can reach an affected Exchange server and knows the common install-time key can supply maliciously crafted, cryptographically signed payloads that the server trusts, triggering code execution without needing per-server secrets. Successful exploitation gives the attacker code execution on the Exchange server, which can be used to access mail data, move laterally, and stage follow-on activity; CISA notes known use in ransomware campaigns. All organizations running the affected on-premises Microsoft Exchange Server are in scope per CISA's listing, though the affected version range is not specified in the source data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, and EPSS rates 30-day exploitation probability at 100% (top percentile).

Do: Apply Microsoft's Exchange security updates addressing CVE-2020-0688 (released in February 2020) to every on-premises Exchange server, per CISA's required action. As an interim mitigation, configure a unique ASP.NET machineKey in each Exchange server's web.config instead of the default shared install-time key, and hunt for indicators of exploitation given the known ransomware use.

Zoho ManageEngine Desktop Central contains a file upload vulnerability (CWE-502, deserialization of untrusted data) that can be exploited without authentication. A remote attacker sends crafted upload requests to the affected application, which accepts and processes the uploaded content without any credentials, resulting in execution of attacker-controlled code. Successful exploitation yields remote code execution on the server hosting Desktop Central, giving the attacker a foothold on an endpoint-management system that typically has broad reach into a corporate network. Any organization running the affected Zoho ManageEngine product is exposed, and exploitability does not depend on user interaction or credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, and EPSS assigns a 99.9% probability of exploitation within 30 days; specific exploited versions are not stated in the available data.

Do: Apply updates per Zoho/ManageEngine vendor instructions immediately, as the CISA KEV required action specifies. Restrict internet exposure of the Desktop Central server and audit it for signs of compromise (unexpected processes, webshells, outbound connections) since unauthenticated RCE has been exploited in the wild. Check that any exposed instances are patched before treating network access as safe.