One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 4954293 |
| Date de publication | 2022-06-03 09:50:26 (vue: 2022-06-03 17:05:57) |
| Titre | Active Exploitation of WSO2 Vulnerability (CVE-2022-29464) Delivers Malware |
| Texte | FortiGuard Labs is aware that a WSO2 vulnerability (CVE-2022-29464) that was patched in February 2022 and was disclosed in April is still being actively exploited in the field. CVE-2022-29464 is an unrestricted arbitrary file upload, and remote code execution vulnerability that allows unauthenticated and remote attackers to execute arbitrary code in the vulnerable WSO2 products. Why is this Significant?This is significant because despite the fact CVE-2022-29464 was patched in February and was disclosed in April, the vulnerability is still being actively exploited. This means that attacks that leverage CVE-2022-29464 have some level of success rate even now. With the vulnerability being actively exploited and a Proof-of-Concept (POC) code became publicly available in late April. users and administrators should review the WSO2's advisory and apply the patch or necessary workaround.Also, CVE-2022-29464 is included in the CISA's Known Exploited Vulnerabilities Catalog, which lists vulnerabilities that US federal agencies are required to patch their information systems within specific timeframes and deadlines.What is CVE-2022-29464?CVE-2022-29464 is a vulnerability in multiple WSO2 products that allows unauthenticated and remote attackers to execute arbitrary code on the affected systems. The vulnerability is rated Critical and has a CVSS Score of 9.8. The advisory has the following products as vulnerable:WSO2 API Manager 2.2.0, up to 4.0.0WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0WSO2 Identity Server as Key Manager 5.3.0, up to 5.11.0WSO2 Enterprise Integrator 6.2.0, up to 6.6.0WSO2 Open Banking AM 1.4.0, up to 2.0.0 WSO2 Open Banking KM 1.4.0, up to 2.0.0What Malware were Deployed after Successful Exploitation of CVE-2022-29464?Cobalt Strike, backdoor, cryptocoin miner and hacktool are reported to have been deployed to the compromised systems.Has the Vendor Released an Advisory?Yes. See the Appendix for a link to "Security Advisory WSO2-2021-1738".Has the Vendor Released a Patch for CVE-2022-29464?Yes. According to the WSO's advisory, WSO2 released temporary mitigations in January 2022 and released permanent fixes for all the supported product versions in February.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against files associated with CVE-2022-29464:W64/Agent.CY!trELF/Agent.AR!trELF/BitCoinMiner.HF!trJava/Agent.AUJ!trJava/Webshell.E!trJava/Webshell.0CC4!trRiskware/Generic.H2Malicious_Behavior.SBFortiGuard Labs provides the following IPS coverage against CVE-2022-29464:WSO2.fileupload.Arbitrary.File.Upload (default action is set to pass)Known network IOCs for CVE-2022-29464 are blocked by the WebFiltering client. |
| Envoyé | Oui |
| Condensat | 0cc4 0what 0wso2 1738 2021 2022 29464 29464:w64/agent 29464:wso2 according action active actively administrators advisory affected after against agencies all allows also analytics api appendix apply april arbitrary are associated attackers attacks auj available aware backdoor banking became because been behavior being blocked catalog cisa client cobalt code compromised concept coverage critical cryptocoin cve cvss deadlines default delivers deployed despite disclosed enterprise even execute execution exploitation exploited fact february federal field file files fileupload fixes following fortiguard h2malicious hacktool has have identity included information integrator iocs ips january key known labs late level leverage link lists malware manager means miner mitigations multiple necessary network now open pass patch patched permanent poc product products proof provides publicly rate rated released remote reported required review sbfortiguard score security see server set should significant some specific status strike success successful supported systems temporary timeframes trelf/agent trelf/bitcoinminer trjava/agent trjava/webshell trriskware/generic unauthenticated unrestricted upload users vendor versions vulnerabilities vulnerability vulnerable vulnerable:wso2 webfiltering what which why within workaround wso wso2 |
| Tags | Malware Vulnerability |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.