Hackers drop crypto mining on vulnerable Struts

By on
Hackers drop crypto mining on vulnerable Struts

Active scanning and exploitation of unpatched boxes afoot.

Researchers have recorded the first mass automated attacks against servers running unpatched versions of the open source Apache Struts enterprise web application framework.

The new vulnerability in Apache Struts was made public four days ago and allows for remote code execution.

Apache has issued patched versions of Struts, version 2.3.35 and 2.5.17, but many administrators have failed to apply the fixed software.

Security vendor Volexity said the scans and exploit attempts started soon after security researcher Prajwal Panchmahalkar released a proof of concept Python script for the vulnerability on Github.

If the exploit code executes successfully on a vulnerable Apache Struts installation, wget requests run to fetch a copy of CNRig Miner - a cryptocurrency miner that runs on Linux distributions - again from Github.

The attacks would also plant a script on vulnerable systems that downloads further Linux ELF binaries for Intel, ARM and MIPS processors.

Volexity said this shows the cryptocurrency miner is capable of running on a wide range of hardware, such as servers, desktops, laptops, IoT devices, wireless routers and other internet connected devices with vulnerable instances of Apache Struts.

Initial scans have come from Russian and French internet protocol addresses, Volexity said.

Volexity warned that while the current round of attacks compromised equipment with cryptocurrency mining payloads, unpatched Apache Struts installations left organisations open to significant risks, including advanced persistent threat (APT) state-sponsored hacking groups gaining access to networks.

Security engineer Dino A Dai Zovi at payments company Square suggested on Twitter a number of common-sense security measures that could mitigate against successful exploitation of the current Apache Struts vulnerability and others that might follow it, on top of patching:

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.

Most Read Articles

Log In

  |  Forgot your password?