Our selection of alerts on honeypots: report 14 – July 2023

A good understanding of active threats is necessary to achieve a good security posture. The following report provides actual trends that emerge from the Internet Background Noise based on the monitoring of two weeks of our Honeypots logs.

Check out our previous report here.

CVE-2023-27350 PaperCut exploit attempt

On the 2^nd of July, one of our German honeypot captured the IP 198.23.251[.]118 hosted by AS 36352 (AS-COLOCROSSING) in the US. This IP address is scarcely known from public databases identifying malicious IP addresses.

This threat actor attempted to exploit CVE-2023-27350 (CVSSv3: 9.8) which is a critical vulnerability on PaperCut MF/NG servers. It turns out to be a Remote Code Execution (RCE) allowing an unauthenticated attacker to execute arbitrary code on the server. This CVE is publicly known since the beginning of May.

The threat actor targeted our German honeypot on port 80/TCP.

HTTP request analyzed by NTA:

GET /app?service=page/SetupCompleted HTTP/1.1 Host: x.xx.xxx.x User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.3319.102 Safari/537.36 Connection: close Accept-Encoding: gzip

TEHTRIS recommends applying the latest patch. Check out the editor’s page for more details .

CVE-2017-7577 exploit attempts

This past couple of weeks, every European honeypots has been hit on port 80/TCP by the following IP address : 193.32.162[.]190 – hosted by AS 47890 (Unmanaged Ltd) in Romania.

Our honeypots were equally targeted as the graphic shows below:

The threat actor was trying to exploit CVE-2017-7577 (CVSSv3: 9.8), a directory traversal vulnerability which affects Xiongmai/HiSilicon DVR and allows the reading of arbitrary files thanks to a GET ../ HTTP request. It is possible to use it for requesting user details for example. Of note, this CVE is not mentioned in CISA’s known exploited vulnerabilities catalog.

HTTP request analyzed by NTA:

GET /../../mnt/mtd/Config/Account1 HTTP/1.1 Host: x.xxx.xx.x User-Agent: Mozilla/5.0 zgrab/0.x Accept: */* Accept-Encoding: gzip

We monitored an increase in exploit attempts of this 6-years old CVE, at the end of June and the beginning of July.

RECENT CVE-2023-27997 EXPLOIT FEASIBILITY STUDY

The CVE-2023-27997 (CVSSv3: 9.8) last month, relates to FortiOS and FortiProxy SSL-VPN. Indeed, they contain a heap-based buffer overflow vulnerability which can allow an unauthenticated remote attacker to execute code using specific crafted requests.

According to bishopfox, it is possible to search for Fortinet servers returning the HTTP response header Server: xxx-xxx. This turns out to be a trustworthy fingerprint for devices running FortiOS. Then, it is possible to filter down on those that redirect to /remote/login, which is the path that exposes the SSL VPN interface.

Therefore the URL /remote/login allows the display of the VPN vulnerable interface. Looking for this request gives information to acknowledge the existence for the page in order to exploit it. It is the preliminary step before the exploit CVE-2023-27997 attempt.

On our honeypots, we captured this specific URL these past weeks. The IP address 179.43.142[.]226, which is known from public databases identifying malicious IP, hosted by AS 51852 (Private Layer INC) in Switzerland, targeted our European and North-American honeypots as follow:

It really started on the 22^nd of June and reached a spike on the 24^th of June and on the 5^th of July. But since the 6^th of July, our honeypots stopped being targeted this way.

For the following steps of the exploit, TEHTRIS NTA monitors the URL, known for being vulnerability’s indicators of exploitation, including:

• /remote/hostcheck_validate
• /remote/logincheck
• /remote/info

TEHTRIS recommends applying updates per vendor instructions.

Bruteforce attack on Portuguese honeypot

Top ports/protocols targeted by threat actors

---