Fake PoC Exploit Targets Security Researchers with Infostealer
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-49113 | Unauthenticated LDAP Denial-of-Service in Microsoft Windows CVE-2024-49113 is an unauthenticated denial-of-service vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) implementation, caused by an out-of-bounds read (CWE-125) and rated 7.5 (high) with network reachability, no privileges and no user interaction required. An attacker who can send crafted LDAP traffic to an affected Windows system can trigger the flaw, crashing the LSASS process; on domain controllers this crashes LSASS and reboots the server, taking authentication and directory services offline. Follow-up research ("Win-DDoS") also showed that internet-exposed domain controllers can be abused as DDoS amplification/reflection agents, extending the impact beyond a single-host outage. Affected systems span essentially all supported Windows clients and servers, from Windows 10 1507 and Windows Server 2008 through Windows 11 24H2 and Windows Server 2022. A public proof-of-concept exploit ("LDAPNightmare") demonstrating an LSASS crash and domain controller reboot has been widely reported; the flaw is not yet in CISA's KEV, but EPSS places it in the 100th percentile with an 83% probability of exploitation within 30 days. Do: Apply the January 2025 Microsoft security updates for CVE-2024-49113, prioritizing domain controllers and other internet-reachable Windows servers. Reduce exposure by not publishing LDAP (389/636) directly to the internet, restricting outbound LDAP referral traffic/egress from domain controllers, and monitoring for LSASS crashes and unexpected reboots. When validating with PoC tooling, use only trusted sources, as fake PoC repositories distributing infostealers and RATs have been reported targeting researchers. | 7.5 | 83% |
| massmass |
Full article436 words · extracted from infosecurity-magazine.com · click to collapse
Threat actors have created a fake proof-of-concept (PoC) exploit for a critical Microsoft vulnerability, designed to lure security researchers into downloading and executing information-stealing malware, Trend Micro has reported.
The fake PoC relates to a critical vulnerability in Microsoft's Windows Lightweight Directory Access Protocol (LDAP), of which a fix was released in the tech giant’s December 2024 Patch Tuesday release.
CVE-2024-49113 is a denial-of-service (DoS) vulnerability that can be exploited to crash the LDAP service, leading to service disruptions.
Trend Micro reported that the attackers set up a malicious repository containing the fake PoC, which, upon execution, leads to sensitive computer and network information being exfiltrated.
This includes researchers’ computer information, process list, directory lists, network IPs, network adapters and installed updates.
PoC exploits are used in the security research community to identify security weaknesses and potential threats to software, enabling action to take place to address the threats.
“Although the tactic of using PoC lures as vehicle for malware delivery is not new, this attack still poses significant concerns, especially since it capitalizes on a trending issue that could potentially affect a larger number of victims,” Trend Micro wrote.
How the PoC Lure Works
The malicious repository containing the PoC appears to be a fork from the original creator, the firm said.
The original Python files were replaced with the executable poc.exe that was packed using UPX. When a user executes the file, a PowerShell script is dropped and executed in the %Temp% folder. This will create a Scheduled Job, which in turn executes an encoded script.
Once decoded, the script downloads another script from Pastebin, which collects the public IP address of the victim’s machine and uploads it using a file transfer protocol.
Computer and network data is then collected and compressed using a ZIP file, after which it is uploaded to an external FTP server using hardcoded credentials.
Security Researchers Warned to Be Vigilant
Trend Micro warned security researchers to be vigilant of fake PoC lures and to use the following best practices to avoid falling victim to this tactic:
- Always download code, libraries and dependencies from official and trusted repositories
- Be cautious of repositories with suspicious content that may seem out of place for the tool or application it is supposedly hosting
- If possible, confirm the identity of the repository owner or organization
- Review the repository’s commit history and recent changes for anomalies or signs of malicious activity
- Be cautious of repositories with very few stars, forks or contributors, especially if they claim to be widely used
- Look for reviews, issues or discussions about the repository to identify potential red flags
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fake-poc-exploit-researchers/