Chinese threats target ThinkPHP applications vulnerable to CVE-2018-20062 and CVE-2019-9082 to install a persistent web shell named Dama.
The web shell makes it possible to further exploit the violated endpoints, for example by enrolling them in the attackers’ infrastructure to evade detection during subsequent operations.
The first signs of this activity date back to October 2023, but according to Akamai analysts who monitor it, the malicious activity has recently spread and intensified.
Targeting old vulnerabilities
ThinkPHP is an open source web application development framework that is particularly popular in China.
CVE-2018-20062, fixed in December 2018, is a problem discovered in NoneCMS 1.3, allowing remote attackers to execute arbitrary PHP code via fraudulent use of the filter parameter.
CVE-2019-9082 impacts ThinkPHP 3.2.4 and earlier, used in Open Source BMS 1.1.1., is a remote command execution issue resolved in February 2019.
Both flaws are exploited in this campaign to allow attackers to execute code remotely, which has an impact on the underlying content management systems (CMS) on the target endpoints.
More precisely, the attackers exploit the bugs to download a text file named « public.txt, » which, in reality, is the obfuscated Dama web shell registered under the name « roeter.php. »
The payload is downloaded from compromised servers located in Hong Kong and provides attackers with remote control of the server after a simple authentication step using the password « admin. »
Akamai claims that the servers providing the payloads are themselves infected by the same web shell, so it seems that the compromised systems are turned into nodes in the attacker’s infrastructure.
The Dama web shell
Dama has advanced capabilities that allow threat actors to navigate the file system on the compromised server, upload files and collect system data, essentially facilitating privilege escalation.
It can also perform network port analysis, access databases and bypass disabled PHP functions for shell command execution.
Une omission notable dans les capacités de Dama est l’absence d’interface de ligne de commande, qui permettrait aux acteurs de la menace une approche plus pratique de l’exécution des commandes.
Akamai note que cette fonctionnalité manquante est notable étant donné les fonctionnalités autrement étendues de Dama.
Atténuation
L’exploitation de failles vieilles de 6 ans rappelle une fois de plus le problème persistant d’une mauvaise gestion des vulnérabilités, car les attaquants, dans ce cas, exploitent des vulnérabilités de sécurité corrigées il y a longtemps.
L’action recommandée pour les organisations potentiellement touchées est de passer au ThinkPHP le plus récent, la version 8.0, qui est sans danger contre les bogues connus d’exécution de code à distance.
Akamai note également que la portée du ciblage de cette campagne est large, affectant même les systèmes n’utilisant pas ThinkPHP, ce qui suggère des motivations opportunistes.