As stated in his blog, he was investigating Magecart card skimming attacks when he noticed something else. Scratching the surface revealed to him that there were multiple active exploits of ThinkPHP vulnerability.
“There are multiple actors abusing this flaw to install everything from a Mirai like botnet to Microsoft Windows malware.”Precisely, he found multiple payload variations attempting to achieve different malicious goals. This includes crypto mining, web shell backdoor, and other malware attacks. The target machines include Windows, Linux and IoT devices. He further explained about the payloads outlined in his report:
“…it appears the Linux infections build a botnet with lot of similarities to Mirai. Windows infections appear to be involved in Crypto Mining activities, trojans, and additional features such as windows password cracking capabilities.”According to his findings, most active exploits are happening in Asia-Pacific – the region from where the ThinkPHP framework originated. However, the attacks do not specifically limit to this area. Rather the attackers are also targeting other locations, including Europe. Precisely, the attackers seem busy in finding as many vulnerable devices as they can for mining Bitcoin and Monero.
“The majority of the attacking IPs are compromised web servers, routers and, IoT devices.”
The vulnerability primarily exists in the ThinkPHP framework – a web framework developed in China. This remote execution flaw (CVE-2018-20062) enables a potential attacker to execute arbitrary codes. As described by FortiGuard Labs,
“The vulnerability is a result of the application's failure to properly sanitize user request. As a result, a remote attacker can send a crafted HTTP request to execute arbitrary code on a vulnerable server.”The flaw targeted the ThinkPHP versions 5.0 and 5.1. The developers then patched the flaw in the recent versions.
However, even after the patch, Cashdollar discovered the continued exploitation of the flaw. Regarding possible remediation, DarkReading stated that he recommends immediate software upgrade to the current patched version of ThinkPHP framework.
