f5_title

Threat Campaigns

This campaign aims to identify servers using FastJson Java library to convert JSON strings to Java objects and vice versa. The threat actor tries to gather more information about the vulnerable server by instructing the server to make a DNS query to a host controlled by the threat actor.

FastJSON Insecure Deserialization Remote Code Execution - dnslog

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor attempts to download and execute a variant of the Mirai Malware.

Log4j2 'Log4Shell' Remote Code Execution - GroovyBypass

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor attempts to download and execute a variant of the Mirai IoT Malware.

Log4j2 'Log4Shell' Remote Code Execution - TomcatBypass

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor instructs the server to return a specific string in response to the malicious request.

Log4j2 'Log4Shell' Remote Code Execution - SpringEcho

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor attempts to verify the vulnerability by triggering a GET request to a remote server by an OS command.

Log4j2 'Log4Shell' Remote Code Execution - Basic Base64

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor instructs the vulnerable server to download and execute a variant of Mirai IoT malware.

Log4j2 'Log4Shell' Remote Code Execution - WebsphereBypass

Log4j2 'Log4Shell' Remote Code Execution - 8UsA

This campaign aims to identify and exploit servers vulnerable to 'Log4Shell' Remote Code Execution. The threat actor attempts to download and execute a PowerShell script that installs a crypto miner (XMR).

Log4j2 'Log4Shell' Remote Code Execution - powershell

This campaign aims to identify and exploit Apache Kylin servers vulnerable to OS Command Injection. The threat actor attempts to verify the vulnerability with a ping back command.

Apache Kylin 'RESTful API' Remote Command Execution - aaa

This campaign aims to identify Apache Solr servers vulnerable to Apache Solr ConfigSet Remote Code Execution (CVE-2020-13957).  An unauthenticated user can execute operating system commands on the server.

Apache Solr ConfigSet Remote Code Execution

Apache Solr fails to properly sanitize "stream.url" parameter which allows an unauthenticated attacker to read local files from the server and perform Server Side Request Forgery (SSRF) attack. The attack does not require valid credentials since the authentication mechanism in Apache Solr is turned off by default.

Apache Solr 'stream.url' Server Side Request Forgery

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

Liferay Insecure Deserialization Remote Code Execution

This campaign aims to identify servers running Liferay CMS vulnerable to Remote Code Execution due to deserialization of untrusted data. The threat actor instructs the server to establish a reverse shell to a remote server.

Liferay Insecure Deserialization Remote Code Execution - bigboat

This campaign aims to identify servers running Liferay CMS vulnerable to Remote Code Execution due to deserialization of untrusted data. The threat actor attempts to download and execute a variant of the 'FreakOut' Malware.

Liferay Insecure Deserialization Remote Code Execution - freakout

This campaign aims to identify servers running Liferay CMS vulnerable to Remote Code Execution due to deserialization of untrusted data. The threat actor tries to gather more information about the vulnerable server by running system commands for reconnaissance.

Liferay Insecure Deserialization Remote Code Execution - cmd2

This campaign aims to identify servers running Liferay CMS vulnerable to Remote Code Execution due to deserialization of untrusted data. The threat actor instructs the device to execute a reverse shell to a remote server. This campaign is part of "N3Cr0m0rPh" IRC bot spreading system.

Liferay Insecure Deserialization Remote Code Execution - N3Cr0m0rPh

This campaign aims to identify servers running Oracle eBusiness Suite application vulnerable to local file inclusion vulnerability within the bispgraph.jsp file. The threat actor tries to read sensitive files on the vulnerable server.

Oracle eBusiness Suite Local File Include - etc windows

This campaign aims to identify Oracle Fusion servers vulnerable to XML External Entity (XXE) injection vulnerability. The threat actor instructs the server to respond with a specific string.

Oracle Fusion Convert Servlet XXE - ong

This campaign aims to identify servers running Oracle eBusiness Suite application vulnerable to XSS. The threat actor attempts to inject JavaScript into the content of the page.

Oracle eBusiness Suite Cross Site Scripting - alert

This campaign aims to identify servers running Oracle eBusiness Suite application vulnerable to deserialization vulnerability which can lead to remote code execution. The threat actor tries to put the server to sleep for a specific amount of time.

Oracle eBusiness Suite Deserialization RCE - sleep

This campaign aims to identify Tomcat servers vulnerable to Apache Tomcat Security Bypass vulnerability (CVE-2012-3546).

Tomcat Form Authentication Bypass - Generic

This campaign aims to identify Apache Tomcat servers vulnerable to  Apache Tomcat Remote Code Execution via JSP upload vulnerability. The threat actor instructs the server to download and execute a DDoS malware.

Apache Tomcat JSP upload via PUT method - mshta

This campaign aims to identify Apache Tomcat servers vulnerable to Remote Code Execution via JSP upload vulnerability. The threat actor instructs the vulnerable server to create a JSP backdoor.

Apache Tomcat JSP upload via PUT method - usAge

This campaign aims to upload a malicious payload to Apache Tomcat Manager servers vulnerable to Apache Tomcat Manager - Application Upload (Authenticated) Code Execution vulnerability (CVE-2009-3548).  A WebShell is uploaded as a WAR archive using a POST request.  Apache Tomcat Manager servers that use blank default password for the administrative user are vulnerable to this exploit.

Apache Tomcat Manager Default Password File Upload - my war

This campaign aims to identify Apache Tomcat based servers vulnerable to  Apache Tomcat CVE-2017-12615 Remote Code Execution vulnerability. The threat actor instructs the server to reply with the string "AAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

Apache Tomcat JSP upload via PUT method - AAAAAAA

This campaign aims to identify Apache Tomcat servers vulnerable to  Apache Tomcat Remote Code Execution via JSP upload vulnerability. The threat actor instructs the vulnerable server to create a JSP backdoor.

Apache Tomcat JSP upload via PUT method - JSPtest2018

This campaign aims to identify Apache Tomcat servers vulnerable to  Apache Tomcat Remote Code Execution via JSP upload vulnerability. The threat actor attempts to upload a Java-based webshell, allowing execution of commands on the server.

Apache Tomcat JSP upload via PUT method - bala123

Apache Tomcat JSP upload via PUT method - cao

This campaign aims to upload a malicious payload  to Apache Tomcat Manager servers vulnerable to Apache Tomcat Manager - Application Upload (Authenticated) Code Execution vulnerability (CVE-2009-3548).  The payload is uploaded as a WAR archive using a POST request.  Apache Tomcat Manager servers that use blank default password for the administrative user are vulnerable to this exploit.

Apache Tomcat Manager Default Password File Upload - deployWar

This campaign aims to identify Apache Tomcat based servers vulnerable to  Apache Tomcat CVE-2017-12615 Remote Code Execution vulnerability. The threat actor instructs the server to return a "WWWW...." string.

Apache Tomcat JSP upload via PUT method - WWWWWWW

This campaign attempts to identify Apache Tomcat webservers that allow uploads and run jsp code. The uploaded code attempts to perform a short text modification and hashing operation, which returns the following string "42d388f8b1db997faaf7dab487f11290". This lets the threat actor know that the server is vulnerable.
The threat actor uses the same technique to install a malware written in JAVA programming language and works on both Windows and Linux machines. The malware creates a socket connection to the Command and Control server and redirects the commands received there to the "cmd.exe" on Windows and "/bin/sh" on Linux machines.
The CnC server was seen used in another campaign deploying PHP shell https://www.virustotal.com/#/file/918689c16d744743bb2c24fe9514d39a53c77eae50dfe1ac697155c082afbd2d

Apache Tomcat JSP upload via PUT method - blahblah

Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622.

Spring Core 'Spring4Shell' Remote Code Execution

This campaign aims to identify Apache Tomcat servers vulnerable to Remote Code Execution via JSP upload vulnerability. The threat actor instructs the vulnerable server to respond with an HTML page indicating a successful command execution.

Apache Tomcat JSP upload via PUT method - myjsp

This campaign aims to identify Apache Tomcat servers with default credentials by sending the authentication requests with popular usernames and passwords.

Tomcat administrator password guessing - Indy Library

This campaign aims to identify Apache Tomcat servers with default credentials. The threat actor sends authentication requests with popular usernames and passwords.

Tomcat administrator password guessing - MSIE 10.0

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.  The threat actor tries to upload a webshell on the vulnerable server.

Spring Core 'Spring4Shell' Remote Code Execution - decoder

Spring Core 'Spring4Shell' Remote Code Execution - kBK

This campaign aims to identify Apache Tomcat based servers vulnerable to file upload via a PUT method (CVE-2017-12617). The threat actor attempt to upload a txt file with a unique string.

Apache Tomcat JSP upload via PUT method - 23nZ

This campaign aims to identify Apache Tomcat servers vulnerable to Apache Tomcat Remote Code Execution via JSP upload vulnerability. The threat actor instructs the server to download and execute a malicious file.

Apache Tomcat JSP upload via PUT method - bulehero

This campaign aims to download and execute malicious files on Apache Tomcat based servers vulnerable to  Apache Tomcat CVE-2017-12617 Remote Code Execution vulnerability. This request is part of the Windows targeting capabilities of "LANCrypt" campaign which is also known for targeting Linux servers to spread "Lucky" ransomware and "XMRig" crypto-currency miner.

Apache Tomcat JSP upload via PUT method - LANCrypt

This campaign aims to identify Apache Tomcat servers vulnerable to Apache Tomcat Remote Code Execution via JSP upload vulnerability. The threat actor attempts to upload a file with a specific string as an indication of compromise.

Apache Tomcat JSP upload via PUT method - rand 32

Apache Tomcat JSP upload via PUT method - smiley

This campaign aims to identify PrimeFaces based servers vulnerable to the Expression Language injection leading to Remote code execution.  The threat actor instructs the server to respond with the content of the "/etc/passwd" file .

PrimeFaces EL Injection Remote Code Execution - ninja

SAP NetWeaver is vulnerable to CSRF vulnerability which could force an authenticated user to change the log file location setting on the SAP server by accessing a maliciouse web page. In addition, the location setting is vulnerable to path traversal which allowing the log file to be set to a publicly accessible location. Combining both vulnerabilities, allows the attacker to inject Java code to the log file and access it leading to a remote code execution on the system.

SAP NetWeaver Log Injection Remote Code Execution

Due to missing authentication, a remote attacker can trigger the "EemAdminService/EemAdmin" endpoint on SAP Solution Manager, and execute Java code on the system.

SAP Solution Manager Missing Authentication Remote Code Execution

An authorized attacker can use a directory traversal attack to access arbitrary files located on the SAP server filesystem including application source code and configuration.

SAP NetWeaver CrashFileDownloadServlet Arbitrary File Read

This campaign aims to identify SAP platforms vulnerable to SAP ConfigServlet Remote Code Execution. An unauthenticated user can execute operating system commands on the server.

SAP ConfigServlet Remote Code Execution

This campaign aims to identify SAP application servers running the SAP NetWeaver Java technology stack - namely in the LM Configuration Wizard component part of the SAP NetWeaver Application Server (AS). The threat actor tries to download a zip file from the vulnerable server.

SAP RECON Remote Code Execution - chipik

SAP NetWeaver is vulnerable to XML External Entity attack, allowing a remote attacker to obtain unauthorized access to the filesystem.

SAP NetWeaver BC-BMT-BPM-DSK XXE

SAP NetWeaver's file upload functionality is vulnerable to a Path Traversal attack, which can result in Remote Code Execution. To exploit this vulnerability, the user must be authenticated.

SAP NetWeaver 'VCParMigrator' Arbitrary File Upload

SAP NetWeaver LM Configuration Wizard does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions. This campaign attempts to leverage this vulnerability in order to create an administrator account on the SAP system.

SAP RECON Remote Code Execution - PwD8890

Due to lack of authentication in the SAP NetWeaver AS Javas LM Configuration Wizard, a remote unauthenticated attacker could creating an administrator user and execute commands on the operating system.

SAP RECON Remote Code Execution

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor instructs the server to execute a reverse shell using Bash.

Apache Apisix 'batch-requests' Remote Code Execution - zli

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor instructs the server to download and execute unknown malware.

Apache Apisix 'batch-requests' Remote Code Execution - QWQ

Apache Apisix 'batch-requests' Remote Code Execution - rms

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor instructs the server to download and execute XMRig cryptocurrency miner.

Apache Apisix 'batch-requests' Remote Code Execution - 462d

This campaign aims to identify Apache OfBiz servers vulnerable to Path Traversal which could lead to Server Side Code Injection attacks.  The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache OfBiz Path Traversal Code Execution - x86

Apache Druid servers are vulnerable to arbitrary command execution. A specially-crafted request from an authenticated user can abuse the JavaScript code functionality to access internal Java classes.  The threat actor in this campaign tries to read the content of /etc/passwd file.

Apache Druid JavaScript Remote Code Execution - passwd

Apache HTTP Server 2.4.49, 2.4.50 and 2.4.51 are vulnerable to Path Traversal attack. This vulnerability combined with "CGI scripts" functionality allows an unauthenticated attacker to execute arbitrary commands on the server.  The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - zero

This campaign aims to identify servers vulnerable to Unauthenticated Remote Code Execution in Apache Hadoop through ResourceManager REST API. The threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache Hadoop Resource Manager Remote Code Execution - drooper

Apache Spark fails to properly sanitize the "doAs" parameter before passing its content. An unauthenticated attacker can leverage this in order to execute arbitrary commands.  The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache Spark 'doAs' Remote Code Execution - zero

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to respond with a md5 hash of a specific string as an indication of compromise.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - md5sum

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor tries to upload a webshell on the vulnerable server.

Apache Apisix 'batch-requests' Remote Code Execution - attack_20

Apache HTTP Server 2.4.49, 2.4.50, and 2.4.51 are vulnerable to Path Traversal attacks. This vulnerability combined with "CGI scripts" functionality allows an unauthenticated attacker to execute arbitrary commands on the server.  In this campaign, the threat actor instructs the vulnerable server to download and execute a variant of Mirai malware.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - Mirai

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remote Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - X

Apache Shiro is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine.  The threat actor attempts to download and execute a reverse shell written in bash.

Apache Shiro 'rememberMe' Unsafe Deserialization -  Testcmd

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution.

Apache Apisix 'batch-requests' Remote Code Execution

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache 'PersistentManager' Remote Code Execution - sys

This campaign aims to identify Apache Apisix servers vulnerable to Remote Code Execution via 'batch-requests' plugin (CVE-2022-24112).  An unauthenticated user can abuse the 'batch-requests' plugin to send requests to bypass the IP restriction of the Admin API, resulting in remote code execution. The threat actor instructs the server to download and execute a variation of Mirai botnet.

Apache Apisix 'batch-requests' Remote Code Execution - as

Apache HTTP Server 'cgi-bin' Path Traversal RCE - redtail

Apache Hadoop Resource Manager Remote Code Execution - skid

This campaign aims to identify and exploit Apache HTTP servers vulnerable to Remode Code Execution due to a Path Traversal vulnerability. The threat actor instructs the server to download and execute an unknown malicious file.

Apache HTTP Server 'cgi-bin' Path Traversal RCE - multi

Apache Apisix 'batch-requests' Remote Code Execution - 27jS

Apache OFBiz 17.12.03 is vulnerable to unsafe deserialization in XML-RPC requests.  This vulnerability can lead to malicious commands being executed on a vulnerable server.

Apache OfBiz Remote Command Execution

This campaign aims to identify Elasticsearch servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return the result of the "whoami" command.

ElasticSearch Search Groovy Sandbox Bypass - whitespaces code

This campaign aims to identify Elasticsearch and exploit servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download a malicious file.

ElasticSearch Search Groovy Sandbox Bypass - udks

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability.  The threat actor instructs the server to return the content of the "/etc/passwd" file.

ElasticSearch Search Groovy Sandbox Bypass - rustorange

This campaign aims to exploit ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the vulnerable server to download a malicious script that further downloads a Monero mining Trojan. It also removes any competing mining trojan, and performs operations to gain persistence. The trojan also tries to connect with other machines in the same subnet via SSH and exploits any Redis installations by bruteforcing weak passwords.

ElasticSearch Search Groovy Sandbox Bypass - GuardMiner

This campaign aims to exploit ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return a "HelloElasticSearch" string in the response to the malicious request.

ElasticSearch Search Groovy Sandbox Bypass - HelloElasticSearch

This campaign aims to identify Elasticsearch servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return "qq952135763" string.

ElasticSearch Search Groovy Sandbox Bypass - qq952135763

This campaign aims to identify Elasticsearch and exploit servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download and execute a malware.

ElasticSearch Search Groovy Sandbox Bypass - Windows_2008ServerR2

This campaign aims to identify Elasticsearch and exploit servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return the result of the "whoami" command as a reconnaissance attempt. If successful, an additional command will be sent in order to download and execute a malicious file.

ElasticSearch Search Groovy Sandbox Bypass - logo9

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability. The threat actor instructs the server to return the string "success" if a file was created on the server's file system.

ElasticSearch Search Groovy Sandbox Bypass - test1234

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability.  The threat actor instructs the device to download and execute an XMRig cryptocurrency miner.

ElasticSearch Search Groovy Sandbox Bypass - z0Miner

This campaign aims to identify Elasticsearch servers vulnerable to ElasticSearch Dynamic Script Arbitrary Java Execution Vulnerability (CVE-2014-3120). The threat actor instructs the server to download and execute a cryptocurrency miner.

ElasticSearch Search Groovy Sandbox Bypass  - YS

This campaign aims to identify Elasticsearch servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return hex representation of a supplied integer.

ElasticSearch Search Groovy Sandbox Bypass - toHexString

This reconnaissance campaign targets servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to ping a domain hosted/controlled by the threat actor.

ElasticSearch Search Groovy Sandbox Bypass - ping

This campaign aims to identify Elasticsearch and exploit servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download a DDoS malware.

ElasticSearch Search Groovy Sandbox Bypass - gxjs

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability.  The threat actor instructs the server to download and execute a malicious file.

ElasticSearch Search Groovy Sandbox Bypass - ctos sh

This campaign aims to identify Elasticsearch servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return the result of the "id" command.

ElasticSearch Search Groovy Sandbox Bypass - def command

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability. The threat actor instructs the server to return the content of the /etc/passwd file.

ElasticSearch Search Groovy Sandbox Bypass - passwd

This campaign aims to exploit ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download and execute a variant of BillGates malware which is used to launch DDoS attacks.

ElasticSearch Search Groovy Sandbox Bypass - BillGates

ElasticSearch Search Groovy Sandbox Bypass - Windows_2003Server

This campaign aims to identify root permissions on Elasticsearch servers vulnerable to Elasticsearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427).

ElasticSearch Search Groovy Sandbox Bypass - rm

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability. The threat actor instructs the server to return a specific string in response to the malicious request.

ElasticSearch Search Groovy Sandbox Bypass - echo random

This campaign aims to exploit ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download and execute a an obfuscated bash script.

ElasticSearch Search Groovy Sandbox Bypass - ICE

ElasticSearch Search Groovy Sandbox Bypass - id

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to return the content of the /etc/passwd file.

ElasticSearch Search Groovy Sandbox Bypass - passwd DNT

This campaign aims to identify ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability.  The worldwide scan seems to be originating from a security researcher for bug bounty purposes potentially related to Synack program.

ElasticSearch Search Groovy Sandbox Bypass - xxe.ninja

This campaign aims to exploit ElasticSearch servers vulnerable to ElasticSearch Groovy Scripting Engine Sandbox Security Bypass Vulnerability (CVE-2015-1427). The threat actor instructs the server to download and execute a malicious bash script.

Threat Campaigns

See also