#cve202332315 — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #cve202332315, aggregated by home.social.
-
"🚨 Openfire Vulnerability Under Active Exploit: A Gateway to Ransomware and Cryptominers 🚨"
The widely-used Openfire chat server is under siege as hackers exploit a high-severity flaw, CVE-2023-32315, to deploy ransomware and cryptominers. This Java-based open-source XMPP server, boasting 9 million downloads, has become a lucrative target due to an authentication bypass vulnerability in its admin console. Attackers are creating new admin accounts on vulnerable servers, installing malicious Java plugins, and executing commands via HTTP requests. 🛑
The flaw spans across various Openfire versions dating back to 2015. Although patches were released in May 2023, over 3,000 servers remained vulnerable by mid-August 2023. The first known exploitation dates back to June 2023, when a server was ransomed post-exploitation. Attack scenarios include deploying crypto-mining trojans, installing backdoors, and extracting server information. 🕵️
Dr. Web has identified four distinct attack scenarios leveraging this flaw, emphasizing the urgency of applying available security updates. BleepingComputer also reports multiple instances of Openfire servers being encrypted with ransomware, appending a .locked1 extension to files. The ransom demands range from 0.09 to 0.12 bitcoins ($2,300 to $3,500). 🖥️🔓
The threat landscape is evolving, with threat actors not solely targeting Openfire servers but any vulnerable web server. It's a stark reminder for organizations to stay vigilant and ensure their systems are up-to-date with the latest security patches. 🛡️
Source: BleepingComputer by Bill Toulas
Tags: #Openfire #Ransomware #Cryptominers #CyberSecurity #Vulnerability #CVE202332315 #ThreatIntel #InfoSec #PatchManagement #ServerSecurity #DrWeb #BleepingComputer 🌐🔐