Attacks/Breaches

New Attacks Target Recent PHP Framework Vulnerability

Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.

Last month a code execution vulnerability was found in the ThinkPHP framework, a rapid-development framework developed by Chinese firm TopThink. While the vulnerability, designated CVE-2018-20062, was patched by the developer, a researcher has now found active exploits of the vulnerability in the wild.

Larry Cashdollar, a vulnerability researcher and member of Akamai's Security Incident Response Team, was doing research on a recent Magecart attack targeting extensions to the Magento e-commerce platform when he noticed a malware request he hadn't seen before – a request to ThinkPHP.

"I realized there was a software framework developed in China that had this vulnerability, and it was being taken advantage of to install coin miners and skimmers," Cashdollar says. "They [also] were using it to install any kind of payload targeting Windows machines, IoT devices, or to mine Bitcoin or Monero coins."

In a blog post describing the new attacks, Cashdollar wrote that multiple threat actors are using relatively simple techniques to take advantage of the vulnerability. He pointed out that a single line of code can scan for the presence of the vulnerability, which can then be exploited with attacks involving simple cut-and-paste code that is widely available.

One of the payloads Cashdollar has seen delivered is a Mirai variant – a development he has worried about, he says. "I had been waiting for Mirai botnet kits to include Web app code in their arsenal," he says, "and this was an indicator that it's happening."

The code being executed through the PHP framework calls can skip a series of steps long considered essential for malware. "Back in the 1990s, people were always trying to get root access," Cashdollar says. "Now it doesn't matter. They just want to execute code on the system as any user so they can share malware or mine coin. They want to execute code on as many systems as possible."

Systems hit by this exploit are largely concentrated in Asia, which is where the ThinkPHP framework was developed and is very popular. Nothing in the attack limits it to the Asia-Pacific region, though, and Cashdollar says that attackers are actively scanning systems across the globe, including Europe and the US. "I'm seeing about 600 scans a day for it," he explains. "They're scanning across all verticals, software companies, car rentals, and others."

Asked about security and remediation, Cashdollar says he has seen some Web application security companies begin to write advisories to their customers regarding the vulnerability. In addition, he recommends that companies ask development groups about the use of the ThinkPHP framework. If it is being used, Cashdollar says, it should be updated to the current version immediately.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
When Your Sandbox Fails
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  4/11/2019
Julian Assange Arrested in London
Dark Reading Staff 4/11/2019
8 'SOC-as-a-Service' Offerings
Steve Zurier, Freelance Writer,  4/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1840
PUBLISHED: 2019-04-18
A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and cause a denial of service (DoS) condition on the affected system. The vulnerability is due to incomplete user-supplied input validation when...
CVE-2019-1841
PUBLISHED: 2019-04-18
A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services without additional authentication. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vuln...
CVE-2019-1826
PUBLISHED: 2019-04-18
A vulnerability in the quality of service (QoS) feature of Cisco Aironet Series Access Points (APs) could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation on QoS fields within Wi-Fi fra...
CVE-2019-1829
PUBLISHED: 2019-04-18
A vulnerability in the CLI of Cisco Aironet Series Access Points (APs) could allow an authenticated, local attacker to gain access to the underlying Linux operating system (OS) without the proper authentication. The attacker would need valid administrator device credentials. The vulnerability is due...
CVE-2019-1830
PUBLISHED: 2019-04-18
A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated, remote attacker to cause the device to unexpectedly restart, which causes a denial of service (DoS) condition. The attacker would need to have valid administr...