New Attacks Target Recent PHP Framework Vulnerability

Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.

Last month a
code execution vulnerability
was found in the ThinkPHP framework, a rapid-development framework developed by Chinese firm TopThink. While the vulnerability, designated
CVE-2018-20062
, was patched by the developer, a researcher has now found active exploits of the vulnerability in the wild.
Larry Cashdollar, a vulnerability researcher and member of Akamais Security Incident Response Team, was doing research on a recent Magecart attack targeting extensions to the Magento e-commerce platform when he noticed a malware request he hadnt seen before – a request to ThinkPHP.
I realized there was a software framework developed in China that had this vulnerability, and it was being taken advantage of to install coin miners and skimmers, Cashdollar says. They [also] were using it to install any kind of payload targeting Windows machines, IoT devices, or to mine Bitcoin or Monero coins.
In a
blog post describing the new attacks
, Cashdollar wrote that multiple threat actors are using relatively simple techniques to take advantage of the vulnerability. He pointed out that a single line of code can scan for the presence of the vulnerability, which can then be exploited with attacks involving simple cut-and-paste code that is widely available.
One of the payloads Cashdollar has seen delivered is a Mirai variant – a development he has worried about, he says. I had been waiting for Mirai botnet kits to include Web app code in their arsenal, he says, and this was an indicator that its happening.
The code being executed through the PHP framework calls can skip a series of steps long considered essential for malware. Back in the 1990s, people were always trying to get root access, Cashdollar says. Now it doesnt matter. They just want to execute code on the system as any user so they can share malware or mine coin. They want to execute code on as many systems as possible.
Systems hit by this exploit are largely concentrated in Asia, which is where the ThinkPHP framework was developed and is very popular. Nothing in the attack limits it to the Asia-Pacific region, though, and Cashdollar says that attackers are actively scanning systems across the globe, including Europe and the US. Im seeing about 600 scans a day for it, he explains. Theyre scanning across all verticals, software companies, car rentals, and others.
Asked about security and remediation, Cashdollar says he has seen some Web application security companies begin to write advisories to their customers regarding the vulnerability. In addition, he recommends that companies ask development groups about the use of the ThinkPHP framework. If it is being used, Cashdollar says, it should be updated to the current version immediately.
Related Content:
NCSC Launches Nation-State Cyber Threat Protection Program for Businesses
100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
Open Bug Bounty Offers Free Program For Websites
7 Business Metrics Security Pros Need to Know

Last News
▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security	▸ Fully committed to the future world of technology. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Attacks Target Recent PHP Framework Vulnerability