Web Hosting Provider Breached Via Adobe ColdFusion Vulnerabilities
Linode says attackers accessed one of its Web servers, some source code, and database
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Web hosting provider Linode said it was hacked via a recently revealed bug in Adobe's ColdFusion that led to the attackers getting access to a Web server, some of its source code, and its database.
Word of trouble at the hosting provider first got out last Friday, when Linode said in a blog post on its website that its system administrators had spotted and blocked "suspicious activity" on its network that appeared to be targeting a single Linode customer, but the firm forced a password reset of all customer accounts as a precaution.
Linode today provided more details on the attack, noting that a hacker group called HTP had taken responsibility for breaching Linode Manager Web servers. The hosting firm says it believes the attackers employed an exploit that went after CVE-2013-1387 and CVE-2013-1388, for which Adobe issued a "hotfix" last week.
"As a result of the vulnerability, this group gained access to a web server, parts of our source code, and ultimately, our database. We have been working around the clock since discovering this vulnerability. Our investigation reveals that this group did not have access to any other component of the Linode infrastructure, including access to the host machines or any other server or service that runs our infrastructure," Linode wrote in its blog post today.
The hosting provider says there's no evidence that credit-card numbers were stolen, namely the last four digits that are stored in clear text. Linode doesn't store user passwords in its database, but it was storing some passwords in clear text, for its Lish shell program, however: "There were occurrences of Lish passwords in clear text in our database. We have corrected this issue and have invalidated all affected Lish passwords effective immediately," the blog says.
Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024