f5cms

 

Key points

Just days after the ThinkPHP vulnerability was discovered, it is already being used on the Internet.

Nearly 46,000 servers, most located in China, are potential targets to exploit this.

Multiple threat actors launched multiple campaigns at the same time, which may show infectious potential.

Campaigns range from checking and uploading back doors to using a variety of Mirai IoT malware.

F5 researchers have recently seen a number of new initiatives that reduce exposure to ThinkPHP, a popular PHP framework in China. Within days of its discovery, multiple threats had already taken advantage of the vulnerability. With this vulnerability, we can see a similar pattern to what we saw in other RCE vulnerabilities, such as Apache Struts 2 - CVE-2017-5638 mentioned last year, where hackers - are heading to rush to take advantage of the time it takes to Get organizations hooked and profit from them. me. New ThinkPHP awareness campaigns are launched every other day. In our experience, although used sparingly, these ventures can last for more than a year.

f5 cms

Remote code deployment vulnerability

On December 9, ThinkPHP released a security update stating that a vulnerability had recently been captured.1 According to ThinkPHP (translated from Chinese), “Because the framework does not find the administrator's name enough, it could generate potential vulnerabilities without the capacity of the emergency route. After examining the code of the vulnerability, it is clear that this vulnerability stems from an unverified input, which allows an attacker to trigger an app.invokefunction action to perform the actions he wants to execute on the affected system. This vulnerability affects versions 5.0 and 5.1 and has been fixed in versions 5.0.23 and 5.1.31.