Microsoft Identifies Botnet Variant Targeting Windows and Linux Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-22947 | Unauthenticated RCE in VMware Spring Cloud Gateway CVE-2022-22947 is a code injection (Spring Expression Language injection) flaw in VMware Spring Cloud Gateway that allows arbitrary remote code execution when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote, unauthenticated attacker can send a maliciously crafted request (typically a crafted POST to the gateway actuator routes endpoint) that is evaluated as code, letting the attacker run arbitrary commands on the host. The CVSS 3.1 score is 10.0 (critical) because exploitation is network-based, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability beyond the vulnerable component. All Spring Cloud Gateway deployments prior to 3.1.1/3.0.7 are affected, along with Oracle products that embed the component, including Commerce Guided Search and multiple Oracle Communications Cloud Native Core functions. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-16, EPSS puts the 30-day exploitation probability at 98.3% (100th percentile), public PoC exploits exist, and related reporting describes botnets adding Spring Cloud Gateway exploits to their attack tooling. Do: Upgrade Spring Cloud Gateway to 3.1.1 or later, or to 3.0.7 or later on the 3.0.x line, per VMware's advisory, and apply the relevant Oracle Critical Patch Update for affected Oracle Commerce Guided Search and Communications Cloud Native Core products. If you cannot patch immediately, disable or restrict the Gateway Actuator endpoint so it is not reachable over the network without authentication. Scan for exposed gateway actuator endpoints and review hosts for signs of command execution; this flaw is on CISA's KEV list, which requires applying updates per vendor instructions. | 10.0 | 98% | KEV PoC ×2 |
| large≈ tens of thousands of deployments plausibly affected worldwide, with only the subset exposing the actuator endpoint unauthenticated directly exploitable from… |
Full article307 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft has warned it has discovered a new variant of the Sysrv botnet, which deploys coin miners on both Windows and Linux systems.
In a thread posted on the Microsoft Security Intelligence (@MsftSecIntel) Twitter account, the tech giant revealed the new variant, which it has named Sysrv-K, is exploiting vulnerabilities in the Spring Framework and WordPress to deploy cryptocurrency miners on these systems.
Microsoft explained that the botnet “scans the internet to find web servers with various vulnerabilities to install itself.” These vulnerabilities range from path traversal and remote file disclosure to arbitrary file download and remote code execution.
Sysrv-K targets a mixture of old vulnerabilities, such as those found in WordPress plugins and newer ones like CVE-2022-22947. All of these have patches, according to Microsoft.
Worryingly, this new version appears to have several new features. These include scanning for WordPress configuration files and their backups to retrieve database credentials, which it uses to gain control of the webserver. In addition, “Sysvr-K has updated communication capabilities, including the ability to use a Telegram bot.”
As with previous versions, Sysrv-K scans for SSH keys, IP addresses and hostnames before trying to spread copies of itself throughout the network. This “could put the rest of the network at risk of becoming part of the Sysrv-K botnet.”
Microsoft advised organizations running either Windows or Linux on internet-facing systems to take action to protect themselves from the new botnet, such as installing all available security updates. “We highly recommend organizations to secure internet-facing systems, including timely application of security updates and building credential hygiene,” it tweeted.
Last week, Microsoft announced it had issued fixes for three zero-day vulnerabilities in its monthly patch Tuesday roundup. The tech giant also recently published a post outlining how the current ransomware-as-a-service (RaaS) pandemic is being fuelled by the tools and services offered by ‘gig’ workers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-botnet-variant-windows/