60
60
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
82
60
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
55
Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.
92
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.
80
60
60
60
60
60