The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security issue affecting the Oracle WebLogic Server to the Known Exploited Vulnerabilities (KEV) database, citing indications of ongoing exploitation.
Tracked as CVE-2017-3506 (CVSS score: 7.4), the problem involves an operating system (OS) command injection vulnerability that might be exploited to get unauthorized access to sensitive servers and assume total control.
"Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document," CISA warned.
While the agency did not specify the kind of attacks using the vulnerability, the China-based cryptojacking gang known as the 8220 Gang (aka Water Sigbin) has a history of leveraging it since early last year to co-opt unpatched devices into a crypto-mining botnet.
According to a recent report published by Trend Micro, the 8220 Gang has been observed weaponizing flaws in the Oracle WebLogic server (CVE-2017-3506 and CVE-2023-21839) to launch a cryptocurrency miner filelessly in memory by means of a shell or PowerShell script depending on the operating system targeted.
"The gang employed obfuscation techniques, such as hexadecimal encoding of URLs and using HTTP over port 443, allowing for stealthy payload delivery," security researcher Sunil Bharti stated. "The PowerShell script and the resulting batch file involved complex encoding, using environment variables to hide malicious code within seemingly benign script components."
In light of the current exploitation of CVE-2017-3506, government entities are encouraged to implement the latest updates before June 24, 2024, to secure their networks against possible threats.
