Vulnerable cloud infrastructure experiencing increasing attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-3088 | Unauthenticated Arbitrary File Upload Leading to RCE in Apache ActiveMQ Fileserver CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign. Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise. | 9.8 | 99% | KEV PoC |
| largetens of thousands of internet-exposed ActiveMQ brokers (public scans index on the order of 10,000-100,000 exposed instances) |
Full article358 words · extracted from helpnetsecurity.com · click to collapse
Attackers are increasingly targeting vulnerable cloud infrastructure to exploit it for covert cryptojacking or to deliver ransomware, Securonix researchers warn.
Some attacks are fairly trivial, but others are multi-vector/multi-platform threats where multiple functionalities are combined as part of the same malicious threat (e.g., XBash, which combines cryptomining, ransomware and botnet/worm activity).
The way in
The attacks are automated and probe the infrastructure and cloud services for vulnerabilities and/or weak or default login credentials.
Among the known exploits leveraged are those for:
- An unauthenticated command execution vulnerability in Apache Hadoop through ResourceManager REST API
- A Redis remote command execution bug
- CVE-2016-3088, an ActiveMQ arbitrary file execution flaw.
“In most cases, the focus of the attacks is on installing a second-stage payload for cryptomining and/or remote access. In other cases, the malware propagates and infects the exposed services, removes data, and installs second-stage cryptomining and ransomware payloads,” the researchers explained.
The attackers achieve the persistence of their malicious implants through cronjob entries on Linux and malicious startup items on Windows systems. They continually change the C&C servers that deliver additional malware, username/password lists, etc.
“XBash is a good example of a more advanced threat actor leveraging many of these common behaviors,” the researchers noted.
The malware infects Linux and Windows systems, installs cryptojacking scripts and spreads through the network by brute-forcing the weak passwords configured on the various services.
Once it successfully logs into the database services, it deletes the existing databases and creates a one with a ransom note specifying the amount and the bitcoin wallet. Unfortunately, those who pay the ransom won’t get anything in return, as the malware did not make backups of the deleted databases.
Keeping the attackers out
Securonix has included indicators of compromise (malicious file hashes, C&C IP addresses), defensive rules for administrators to use and pointed them towards specific logs that may show evidence of compromise.
The company is also advising them to continuously review their cloud infrastructure services’ exposure to the internet and restrict access whenever possible; think about deploying a centralized patch management system; consider implementing Redis in protected mode and implementing strong password policies for all services.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/01/25/cloud-infrastructure-attacks/