Hackers are exploiting a server vulnerability with a severity of 9.Eight out of 10

In a growth safety professionals feared, attackers are actively focusing on yet one more set of important server vulnerabilities that depart firms and governments open to critical community intrusions.

The vulnerability this time is in BIG-IP, a line of server home equipment bought by Seattle-based F5 Networks. Prospects use BIG-IP servers to handle visitors going into and out of enormous networks. Duties embrace load balancing, DDoS mitigation, and net utility safety.

Final week, F5 disclosed and patched important BIG-IP vulnerabilities that enable hackers to realize full management of a server. Regardless of a severity score of 9.Eight out of 10, the safety flaws received overshadowed by a special set of important vulnerabilities Microsoft disclosed and patched in Change server per week earlier. Inside a number of days of Microsoft’s emergency replace, tens of hundreds of Change servers within the US had been compromised.

Day of reckoning

When safety researchers weren’t busy attending to the unfolding Change mass compromise, a lot of them warned that it was solely a matter of time earlier than the F5 vulnerabilities additionally got here underneath assault. Now, that day has come.

Researchers at safety agency NCC Group on Friday said they’re “seeing full chain exploitation” of CVE-2021-22986, a vulnerability that permits distant attackers with no password or different credentials to execute instructions of their alternative on susceptible BIG-IP units.

“After seeing a lot of damaged exploits and failed makes an attempt, we are actually seeing profitable within the wild exploitation of this vulnerability, as of this morning,” Wealthy Warren, Principal Safety Guide at NCC Group and co-author of the weblog wrote.

In a weblog submit NCC Group posted a screenshot displaying exploit code that would efficiently steal an authenticated session token, which is a sort of browser cookie that permits directors to make use of a web-based programming interface to remotely management BIG-IP {hardware}.

“The attackers are hitting a number of honeypots in several areas, suggesting that there isn’t any particular focusing on,” Warren wrote in an e mail. “It’s extra possible that they’re ‘spraying’ makes an attempt throughout the web, within the hope that they’ll exploit the vulnerability earlier than organizations have an opportunity to patch it.”

He mentioned that earlier makes an attempt used incomplete exploits that had been derived from the restricted info that was out there publicly.

Safety agency Palo Alto Networks, in the meantime, said that CVE-2021-22986 was being focused by a units contaminated with a variant of the open-source Mirai malware. The tweet mentioned the variant was “making an attempt to use” the vulnerability, but it surely wasn’t clear if the makes an attempt had been profitable.

Different researchers reported Web-wide scans designed to find BIG-IP servers which can be susceptible.

CVE-2021-22986 is just one of a number of important BIG-IP vulnerabilities F5 disclosed and patched final week. The severity Partially is as a result of the vulnerabilities require restricted talent to use. However extra importantly, as soon as attackers have management of a BIG-IP server, they’re roughly contained in the safety perimeter of the community utilizing it. Meaning attackers can shortly entry different delicate elements of the community.

As if admins did not have already got sufficient to take care of, patching susceptible BIG-IP servers and in search of exploits ought to be a high precedence. NCC Group offered indicators of compromise within the hyperlink above, and Palo Alto Networks has IOCs here.

Replace 8:22 pm EDT: After this submit went reside, F5 issued an announcement. It learn: “We’re conscious of assaults focusing on current vulnerabilities revealed by F5. As with all important vulnerabilities, we advise prospects replace their methods as quickly as potential.”

In the meantime, NCC Group’s Wealthy Warren responded to questions I despatched earlier. Here is a partial Q&A:

What does “seeing full chain exploitation” imply? What was NCC Group seeing earlier than, and the way does “full chain exploitation” change it?

What we imply is that, beforehand we had been seeing attackers making an attempt to abuse the SSRF vulnerability in a manner which couldn’t work, as a result of an essential a part of the exploit was not public data, due to this fact the exploits would fail. Now, attackers have discovered the total particulars wanted to make use of the SSRF to bypass authentication and procure authentication tokens. These authentication tokens can then be used to execute instructions remotely. Thus far, now we have seen the attackers a) receive an authentication token, and b) execute instructions to dump credentials. We’ve not seen any web-shells being dropped like we did with CVE-2020-5902, but.

The place, exactly, are you seeing the exploit makes an attempt? Is it in a honeypot, on manufacturing servers, elsewhere?
The attackers are hitting a number of honeypots in several areas, suggesting that there isn’t any particular focusing on. It’s extra possible that they’re “spraying” makes an attempt throughout the web, within the hope that they’ll exploit the vulnerability earlier than organizations have an opportunity to patch it. Earlier makes an attempt we noticed towards our honeypot infrastructure confirmed that attackers had been utilizing incomplete exploits primarily based on restricted info that was out there within the public area. This exhibits that attackers are clearly eager to use the vulnerability – even when a few of them haven’t got the requisite data to engineer their very own assault code.

Are you aware if the exploits are succeeding in compromising manufacturing servers? If sure, what are attackers doing post-exploitation?

In the meanwhile, we will not touch upon whether or not the identical attackers have been profitable towards different individuals’s servers. As regards to post-exploitation actions, now we have solely seen credential dumping to date.

I am studying that a number of risk teams are exploiting the vulnerability. Are you aware this to be true? In that case, what number of totally different risk actors are there?

We have not acknowledged that there are a number of attackers. In truth, whereas we have seen a number of profitable exploitation makes an attempt from totally different IPs, all makes an attempt have contained some particular hallmarks that are in line with the opposite makes an attempt, suggesting it is possible the identical underlying exploit.