Days after cybersecurity researchers sounded the alarm over two critical vulnerabilities in the SaltStack configuration framework, a hacking campaign has already begun exploiting the flaws to breach servers of LineageOS, Ghost, and DigiCert.
Tracked as CVE-2020-11651 and CVE-2020-11652, the disclosed flaws could allow an adversary to execute arbitrary code on remote servers deployed in data centers and cloud environments. The issues were fixed by SaltStack in a release published on April 29th.
LineageOS, a maker of an open-source operating system based on Android, said it detected the intrusion on May 2nd at around 8 pm Pacific Time.
“Around 8 pm PST on May 2nd, 2020, an attacker used a CVE in our SaltStack master to gain access to our infrastructure,” the company noted in its incident report but added Android builds and signing keys were unaffected by the breach.
Ghost, a Node.js based blogging platform, also fell victim to the same flaw. In its status page, the developers noted that “around 1:30 am UTC on May 3rd, 2020, an attacker used a CVE in our SaltStack master to gain access to our infrastructure” and install a cryptocurrency miner.
“The mining attempt spiked CPUs and quickly overloaded most of our systems, which alerted us to the issue immediately,” Ghost added.
Ghost, however, confirmed there was no evidence the incident resulted in a compromise of customer data, passwords, and financial information.
Both LineageOS and Ghost have restored the services after taking the servers offline to patch the systems and secure them behind a new firewall.
In a separate development, the Salt vulnerability was used to hack into DigiCert certificate authority as well.
“We discovered today that CT Log 2’s key used to sign SCTs (signed certificate timestamps) was compromised last night at 7 pm via the Salt vulnerability,” DigiCert’s VP of Product Jeremy Rowley said in a Google Groups post made on Sunday.
“Although we don’t think the key was used to sign SCTs (the attacker doesn’t seem to realize that they gained access to the keys and were running other services on the infrastructure), any SCTs provided from that log after 7 pm MST yesterday are suspect. The log should be pulled from the trusted log list.”
With F-Secure’s alert revealing more than 6,000 Salt vulnerable servers that can be exploited via this vulnerability, if left unpatched, companies are advised to update the Salt software packages to the latest version to resolve the flaws.
The information contained in this website is for general information purposes only. The information is gathered from The Hacker News, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.