The first vulnerability is a local file inclusion (LFI) issue in the language parameter of ThinkPHP Framework before 6.0.14. An unauthenticated remote attacker can leverage it to execute arbitrary operating system commands in deployments where the language pack feature is enabled. Threat monitoring platform GreyNoise is reporting spikes in actors leveraging CVE-2022-47945 and CVE-2023-49103 that affect ThinkPHP Framework and the open-source ownCloud solution for file sharing and syncing. Both vulnerabilities have critical severity and can be exploited to execute arbitrary operating system commands or to obtain sensitive data (e.g. admin password, mail server credentials, license key). Increased hacker activity has been observed in attempts to compromise poorly maintained devices that are vulnerable to older security issues from 2022 and 2023. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. This is despite its low Exploit Prediction Scoring System (EPSS) rating of 7% and the flaw not being included in CISA's Known Exploited Vulnerabilities (KEV) catalog. According to threat monitoring platform GreyNoise, CVE-2022-47945 is under high-volume exploitation right now, with attacks launched from a growing number of source IPs. "GreyNoise has observed 572 unique IPs attempting to exploit this vulnerability, with activity increasing in recent days," warns the bulletin. Akamai reported last summer that Chinese threat actors have been leveraging the flaw since October 2023 in narrow-scope operations. Soon after the vulnerability's initial disclosure from the developers in November 2023, hackers started exploiting it to steal sensitive information from unpatched systems. GreyNoise observed increased exploitation of CVE-2023-49103 recently, with malicious activity originating from 484 unique IPs. Despite over 2 years having passed since the vendor released an update that addresses the security issue, many instances remain unpatched and exposed to attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 12 Feb 2025 23:05:18 +0000