TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Vulnerabilities, Exploits, and Malware Driving Attack Campaigns in November 2019

2019-12-24 · Read original ↗

ATT&CK techniques detected

6 predictions
T1190Exploit Public-Facing Application
98%
"rce vulnerability. the threat actor tries to upload a web shell on a vulnerable server. - rejetto http file server rce ( cve - 2014 - 6287 ) : this campaign aims to identify rejetto http file servers vulnerable to rejetto http file server rce vulnerability. the threat actor instr…"
T1190Exploit Public-Facing Application
96%
"vulnerabilities, exploits, and malware driving attack campaigns in november 2019 security researchers at f5 networks constantly monitor web traffic at various locations all over the world. this allows us to detect “ in the wild ” malware and get insights into the current threat l…"
T1190Exploit Public-Facing Application
72%
"in figure 1, php - fpm calls fcgi _ putenv to replace the value of orig _ script _ name and replaces it with the value controlled by an attacker. this allows an attacker to create a fake php _ value fcgi variable and use a chain of carefully chosen config values to get remote cod…"
T1190Exploit Public-Facing Application
57%
"\ " $ _ get [ a ] `? > \ " ", these requests corrupt the existing cgi environment variables and allow the threat actor to execute commands remotely, including the ‘ which which ’ command. in this campaign, the threat actor tries to execute the ' which which ' command on a vulnera…"
T1221Template Injection
43%
"the request parameters to see if _ template key is present, and if it isn ' t, it uses a predefined template. this parameter _ template is not defined in the widgetmacro docs and it can be controlled by a user. a malicious user can send a request with _ template as a parameter an…"
T1059.006Python
32%
"in figure 1, php - fpm calls fcgi _ putenv to replace the value of orig _ script _ name and replaces it with the value controlled by an attacker. this allows an attacker to create a fake php _ value fcgi variable and use a chain of carefully chosen config values to get remote cod…"

Summary

New campaign activity for remote code execution (RCE) vulnerabilities disclosed this year picked up in the month of November.