The Top Web Service Exploits in 2020
Join us for a look at 2020’s top ten most prevalent exploits targeting web services leveraged in large scale attacks or reconnaissance campaigns as seen by Radware’s Threat Research Center.
The Threat Research Center monitors and researches malicious traffic and vulnerability exploits using Radware’s Global Deception Network, which is a network of globally distributed darknet deception agents – honeypots – running services that attract bots attempting to compromise, abuse, hack into computers, create new botnets and launch DDoS attacks. The deception network attracts hundreds of thousands of malicious source IPs that generate millions of events daily. The automatic analysis algorithms provide insights and categorization of various types of malicious activity from reconnaissance through password brute force attempts to injections and RCE.
Radware proprietary and patented algorithms running on the deception network are used to catalog and identify new and emerging threat actors, including web application attackers, botnets, IoT bots, and DNS attackers, as well as to analyze malicious behavior designed to hide the attacker such as spoofing and anonymizing.
Let’s drill down into the top 10 Service exploits identified in 2020:
Service Exploit #1: /ws/v1/cluster/apps/new-application
74.85% of all web services hits.
Apache Hadoop Unauthenticated Command Execution via YARN ResourceManager.
Hadoop is an open-source distributed processing framework designed to manage storage and data processing for big data applications running in clustered systems. In October 2018 Radware discovered the DemonBot, a malicious agent designed to run on vulnerable Hadoop servers. The original bot was first seen in Radware’s Threat Deception Network in September 2018 scanning and trying to execute the request to /ws/v1/cluster/apps/new-application, which is the first step to exploit exposed unprotected Hadoop server, today though rarely seen in the wild, its successors take first place in scanning attempts.
What is the risk? A successful attack could allow an unauthenticated attacker to execute commands on the vulnerable server which may lead to data leakage and complete takeover of the server.
[You may also like: Hadoop YARN: An Assessment of the Attack Surface and Its Exploits]
Service Exploit #2: /manager/html
11.27% of all web services hits.
Apache Tomcat Manager Application Upload Authenticated Code Execution.
Apache Tomcat is an open-source HTTP web server written in Java under license Apache License 2.0. This module can be used to execute a payload on Apache Tomcat servers that have an exposed “manager” application. The payload is uploaded as a WAR archive containing a JSP application using a POST request against the /manager/html/upload component.
What is the risk? This vulnerability can allow an attacker to abuse the server in many ways such as steal user’s data, use the server resources for crypto mining, establish continuous control over it, and/or use it to hack another server.
Service Exploit #3: /level/15/exec/-/sh/run/CR
6.9% of all web services hits.
Cisco routers without authentication on the HTTP interface.
Cisco Systems, Inc. develops, manufactures, and sells networking hardware, software telecommunications equipment, and other high-technology services and products. In Aug 2002 Cisco released Cisco IOS 11.2 for Cisco routers which offered a new HTTP interface that provided an HTTP 1.0-compliant Web server in the IOS. This HTTP server allowed a user to execute commands directly from a URL. Attackers keep trying to find the unprotected Cisco routers, those without authentication on the HTTP interface.
What is the risk? An exposed router may allow a remote unauthenticated attacker to execute commands directly from a URL to receive configuration files of Cisco routers, scan an internal network, and detect additional devices in the NAT. This activity can allow an anonymous attacker to explore and abuse the internal network hidden after a compromised router.
[You may also like: FireEye Hack Turns into a Global Supply Chain Attack]
Service Exploit #4: /admin/assets/js/views/login.js
1.56% of all web services hits.
Sangoma FreePBX – multiple vulnerabilities.
Sangoma FreePBX is a web-based open-source graphical user interface, GUI, that helps to install and configure an Asterisk-based (a voice over IP and telephony server) open-source phone system on a server or virtual environment. Starting in 2018, many requests for the resource /admin/assets/js/views/login.js were identified and captured in Radware’s Threat Deception Network. This resource belongs to Sangoma FreePBX code and it looks like the attackers are trying to detect vulnerable FreePBX servers and exploit one of the known vulnerabilities.
What is the risk? The compromised server can be used to steal user’s data, crypto mining, or any other malicious usage.
Service Exploit #5: /ftptest.cgi?loginuse=&loginpas=
1.2% of all web services hits.
WIFICAM web camera – multiple vulnerabilities.
Many cheap Wireless IP web cameras use the same genetic code based on the GoAhead code (the tiny, embedded web server). This code includes multiple vulnerabilities where the most serious one is command injection.
In May 2017 an article was published about the Persirai botnet which exploits the vulnerabilities of these cameras to spread itself and launch high volumetric distributed Denial-of-Service (DDoS) attacks.
What is the risk? This vulnerability allows a remote attacker to inject arbitrary commands and achieve a complete takeover of the camera. Spying the videos received from the camera, steeling the video records, usage the camera to explore the internal networks – all those are a small part of possible activities available to attackers.
Service Exploit #6: /service/extdirect
0.92% of all web services hits.
Sonatype Nexus Repository Manager – Remote Code Execution.
Nexus Repository Manager is an open-source Repository Manager that allows to a proxy collect and manage dependencies developed by Sonatype. In 2019-02-05, Sonatype Security Team released a Critical Security Advisory which covered CVE-2019-7238. Affected versions are Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.14.0.
The vulnerability, CVE-2019-7238, allows a remote attacker to inject and execute code on the server that could potentially affect confidentiality, integrity, and availability by sending a specially crafted request to the Sonatype Nexus Repository Manager server. For further information see here.
What is the risk? In addition to other usages of the Remote Code Execution Vulnerability, in this case, there is an additional dangerous scenario – an attacker can inject any code into the code storage and affect any product in its development stage.
Service Exploit #7: /solr/admin/info/system?wt=json
0.48% of all web services hits.
Apache Solr – Directory traversal vulnerability.
Apache Solr is an open-source enterprise search platform built on Apache Lucene. On May 30, 2013, Apache foundation published security issue SOLR-4882 with was related to CVE-2013-6397, the affected version was 4.3. The issue was resolved in version 4.6 and a patch from September 21, 2013.
What is the risk? The vulnerability, CVE-2013-6397 allows a remote attacker to read arbitrary files on the Solr server via the “tr” parameter. This, when combined with other vulnerabilities, may lead to remote code execution on the victim server. Attackers are scanning the internet using the above URL to find the old and unpatched Solr servers that are still vulnerable to CVE-2013-6397. The attacker can use the potential of the Remote Code Execution on a compromised server.
[You may also like: You’re Only As Protected As Your Provider’s SOC]
Service Exploit #8: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
0.42% of all web services hits.
PHPUnit testing framework for PHP – Remote Code Execution.
PHPUnit is a programmer-oriented testing framework for PHP language. Like other unit testing frameworks, PHPUnit allows PHP developers to find mistakes in their newly committed code. In Jun 2017, CVE-2017-9841 that addresses the vulnerability was issued.
What is the risk? The vulnerability, CVE-2017-9841 allows a remote attacker to execute arbitrary code on an affected PHPUnit server. A remote unauthenticated attacker can send a malicious HTTP POST request to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI, which may lead to a complete takeover of a vulnerable PHPUnit server.
Service Exploit #9: /hudson
0.4% of all web services hits.
Hudson continuous integration tool – multiple vulnerabilities.
Hudson is a continuous integration tool written in Java, which runs in a servlet container, such as Apache Tomcat or the GlassFish application server. Over the years the project was replaced by Jenkins. The final release. 3.3.3 was on February 15, 2016. Today Hudson is no longer maintained and was announced as obsolete in February 2017.
What is the risk? Since Hudson is still in use (albeit it is no longer maintained), attackers keep trying to find and identify Hudson servers to attack unhandled security vulnerabilities.
Other Service Exploits
1.99% of all web services hits.
In addition to the new items that we covered in this list, we have also seen items that we already saw and covered in our previous blog Top 10 Web Service Exploits in 2019 such as /ctrlt/DeviceUpgrade_1, /TP/public/index.php and /nice%20ports%2C/Tri%6Eity.txt%2ebak.
To Summarize…
A whopping 75% of the hits in Radware’s Deception Network were attempting to exploit the Apache Hadoop vulnerability, a well-known vulnerability from 2018 that was covered in Radware’s blog “New DemonBot Discovered”. Today though DeamonBot is a rare sight, its successors and many other malicious bots are still exploiting this vulnerability.
As for the other attacks, although the trending vulnerabilities that attackers choose to exploit have changed, the focus is the same as last year. It is not necessarily on new attacks and new attack vectors as one would expect, but rather on popular technologies and devices with known and easy to exploit vulnerabilities, going back to vulnerabilities initially reported in 2013.
Organizations that lag so far behind with upgrading or patching these vulnerabilities, are recommended to implement patches on their assets as soon as possible.
