New LABRAT Campaign Exploits GitLab Flaw for Cryptojacking and Proxyjacking Activities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) GitLab CE/EE versions from 11.9 onward fail to properly validate image files before passing them to the bundled ExifTool file parser, enabling command/code injection (CWE-94). A remote, unauthenticated attacker triggers it by getting the server to parse a specially crafted image (e.g., through file-upload features), with no credentials or user interaction required. Successful exploitation yields arbitrary command execution on the GitLab server, exposing source code, credentials, CI/CD data, and the wider network (CVSS 10.0, scope-changed). All self-managed GitLab Community and Enterprise Edition deployments on affected versions are exposed. The flaw is actively exploited in the wild: it is on CISA's KEV with known ransomware use, public PoCs exist, and 2021 campaigns used it for ransomware, cryptojacking, and access brokering against GitLab servers. Do: Upgrade immediately to the patched releases - 13.10.3 or later, or the corresponding 13.9.6/13.8.6/13.7.9 backports - per vendor instructions, as required for KEV entries. Until patched, restrict network access to internet-facing GitLab instances and verify the bundled ExifTool is current. Hunt for signs of compromise (suspicious processes or cron jobs, cryptominers, webshells, new SSH keys, unexpected outbound connections), given documented ransomware and cryptojacking abuse. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed self-managed GitLab instances (order of ~50,000+ servers in public scans) | |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) CVE-2021-4034 ('PwnKit') is an out-of-bounds read and write (CWE-125/CWE-787) in polkit's setuid-root pkexec utility, which mishandles the calling parameter count and ends up trying to execute environment variables as commands. A local attacker who runs pkexec with crafted environment variables can induce it to execute arbitrary code, gaining administrative (root) rights on the target machine. Because polkit is installed by default on mainstream Linux distributions — including Red Hat Enterprise Linux and its many variants, with the flaw also tracked against Canonical, SUSE, Oracle, Siemens, and StarWind Software products — essentially every standard Linux installation was exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-06-27 with known ransomware use, and EPSS assigns a 94.9% probability of exploitation (100th percentile). Public proof-of-concept exploits are widely available, making exploitation trivial for any user with local access to an unpatched host. Do: Apply the polkit/pkexec updates from each distribution vendor immediately per vendor instructions, as required by the CISA KEV catalog. If patching must be delayed, removing the setuid bit from pkexec (e.g., chmod 0755 /usr/bin/pkexec) is a widely documented interim mitigation, though it may affect functionality that relies on pkexec. Prioritize hosts where untrusted or low-privilege users can log in, and hunt for prior exploitation given known ransomware use. | 7.8 | 95% | KEV ransomware PoC ×4 |
| masstens of millions of Linux servers and workstations (polkit/pkexec ships by default on virtually all mainstream distributions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | trycloudflare.com | It launches a process that generates a random subdomain on trycloudflare.com, thereby allowing internal resources to be exposed to the p |
Full article623 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 17, 2023Cryptojacking / Proxyjacking
A new, financially motivated operation dubbed LABRAT has been observed weaponizing a now-patched critical flaw in GitLab as part of a cryptojacking and proxyjacking campaign.
"The attacker utilized undetected signature-based tools, sophisticated and stealthy cross-platform malware, command-and-control (C2) tools which bypassed firewalls, and kernel-based rootkits to hide their presence," Sysdig said in a report shared with The Hacker News.
"Furthermore, the attacker abused a legitimate service, TryCloudflare, to obfuscate their C2 network."
Proxyjacking allows the attacker to rent the compromised host out to a proxy network, making it possible to monetize the unused bandwidth. Cryptojacking, on the other hand, refers to the abuse of the system resources to mine cryptocurrency.
A notable aspect of the campaign is the use of compiled binaries written in Go and .NET to fly under the radar, with LABRAT also providing backdoor access to the infected systems. This could ultimately pave the way for follow-on attacks, data theft, and ransomware.
The attack chains begin with the exploitation of CVE-2021-22205 (CVSS score: 10.0), a remote code execution vulnerability that has been exploited in the wild by Indonesian-origin actors in the past to deploy crypto miners.
A successful break-in is followed by the retrieval of a dropper shell script from a C2 server that sets up persistence, conducts lateral movement using SSH credentials found in the system, and downloads additional binaries from a private GitLab repository.
"During the LABRAT operation, TryCloudflare was used to redirect connections to a password-protected web server that hosted a malicious shell script," Miguel Hernández said. "Using the legitimate TryCloudFlare infrastructure can make it difficult for defenders to identify subdomains as malicious, especially if it is used in normal operations too."
TryCloudflare is a free tool that can be used to create a Cloudflare Tunnel without adding a site to Cloudflare's DNS. It launches a process that generates a random subdomain on trycloudflare.com, thereby allowing internal resources to be exposed to the public internet.
The development adds to the abuse of cloudflared to establish covert communication channels from compromised hosts and main access to victim networks.
In a second variation of the attack, the adversary is said to have used a Solr server instead of TryCloudflare to download an exploit for the PwnKit (CVE-2021-4034) from the same GitLab repository to elevate privileges, along with another file that's no longer accessible.
Some of the payloads retrieved by the dropper script include an open-source utility known as Global Socket (gsocket) for remote access and binaries to conduct cryptojacking and proxyjacking via known services such as IPRoyal and ProxyLite. The mining process is concealed using a kernel-based rootkit called hiding-cryptominers-linux-rootkit.
Also delivered is a Go-based executable designed to ensure persistence and kill competing mining processes or older versions of itself in order to fully harness the machine's resources and maximize their earnings.
"Since the goal of the LABRAT operation is financial, time is money," Hernández said. "The longer a compromise goes undetected, the more money the attacker makes and the more it will cost the victim."
Update
GitLab shared the following statement with The Hacker News following the publication of the story -
Users impacted by CVE-2021-22205 should follow their organization's Security Incident and Disaster Recovery processes to deprovision the compromised instance and restore the latest good working backup to a new GitLab instance. The vulnerability has been patched since 2021 and the impact is on customers who remain on vulnerable versions. We issued a blog post regarding the vulnerability and a forum post about how users can determine if they have been impacted.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/08/new-labrat-campaign-exploits-gitlab.html