/
← Voltar ao feed
medium exploit público

Azure-hosted cluster scans for planted WordPress webshells tied to CVE-2018-14028, per F5 Honeynet March 2026 data

1 fonte(s) · 1 atualização(ões) · publicado 14/04/2026 21:40 · coletado há 1 dia

F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes for PHP webshells already planted in predictable WordPress paths, such as /wp-content/uploads/*.php and the date-stamped /uploads/2021/02/. Of the top 30 source IPs, 29 sit in Microsoft Azure address space, which suggests a single operator running cloud-provisioned, multi-purpose scanning nodes. The scanning was indiscriminate, with WordPress paths sprayed at all application types. F5 offers three possible motives: harvesting the operator's own earlier webshells, hijacking other actors' webshells, or identifying compromised sites for later exploitation. The activity scaled from low-volume, geographically dispersed testing in January-February to concentrated higher-volume scanning in March.

Technical Details

  • CVE-2018-14028 (CWE-434) requires admin credentials. A raw PHP file uploaded via the plugin upload function is not cleaned up after the ZIP extraction fails, so it remains reachable and gives RCE as the web server process.
  • Scanned filenames are generic (index.php, about.php, admin.php), suggesting a toolkit with standardized naming.
  • The same Azure IPs also probe CVE-2017-12932 (PHP deserialization) and generate tens of thousands of non-CVE events, indicating general-purpose reconnaissance toolkits.
  • The top source IP 74.235.238.88 produced 313 events in March, against a top source of 269 events in the prior period. Other ranges cited: 20.x, 4.204.x, 52.x, 40.x, 74.235.x, 172.190.x.
  • Wider March 2026 data: CVE-2024-4577 led with 16,271 attacks, CVE-2025-55182 (React Server Components, CVSS 10.0) rose to 4,290, and CVE-2020-15505 (MobileIron Core) entered at position 10 with 1,410. The US, Germany and Canada were the top attack sources.

Remediation

  • Audit wp-content/uploads/, wp-content/upgrade/ and date-stamped subdirectories (especially /uploads/2021/02/) for PHP files. Treat any as a confirmed compromise.
  • Block PHP execution in upload and upgrade directories.
  • Update WordPress, enforce MFA and strong credentials on admin accounts, and remove unauthorized admins.
  • Deploy file integrity monitoring and WAF rules for PHP requests in upload paths, and log and rate-limit cloud-sourced requests to those paths.

4 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2025-55182, CVE-2024-4577, CVE-2017-9841 e outros. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52506 ↗ · aplicação web · multiple · pub. 09/04/2026 não verificado

    React Server 19.2.0 - Remote Code Execution

    The script targets CVE-2025-55182, a flaw in how React Server Components deserialize data sent to server function endpoints, as used by frameworks such as Next.js. An unauthenticated attacker with network access to an app running React 19.0.0 to 19.2.0 can trigger it with one crafted POST, no user interaction. It abuses object handling to run JavaScript on the server, giving command execution as the app user. It is a working-looking, blind PoC that scans a target list and leaks command output via DNS lookups; it only prints HTTP status.

    CVE-2025-55182 · autor: danieljavanrad · explicação gerada por IA
  2. exploit-db.com · EDB-52331 ↗ · aplicação web · php · pub. 15/06/2025 não verificado

    PHP CGI Module 8.3.4 - Remote Code Execution (RCE)

    This script exploits CVE-2024-4577, an argument injection flaw in PHP running as CGI on Windows, where a soft hyphen in the query string is turned into a dash and lets the attacker pass configuration options to the interpreter. It needs only network access to an exposed php-cgi executable, with no login or user interaction. The options make PHP run code sent in the request body, giving command execution as the web server user. It looks like a working exploit with multi-host scanning and an interactive shell.

    CVE-2024-4577 · autor: İbrahimsql · explicação gerada por IA
  3. exploit-db.com · EDB-50702 ↗ · aplicação web · php · pub. 02/02/2022 não verificado

    PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)

    This script exploits CVE-2017-9841: PHPUnit's eval-stdin helper, when left reachable in a web-exposed vendor directory, executes any PHP code sent in an HTTP request body. The attacker needs only network access to a site that deployed PHPUnit (a dev dependency) publicly, with no login or user interaction. The tool checks several common framework layouts with a harmless test, then offers an interactive prompt that runs system commands as the web server user. It is a simple, working exploit that matches the CVE.

    CVE-2017-9841 · autor: souzo · explicação gerada por IA

Linha do tempo

  1. f5.com ↗ · pub. 14/04/2026 21:40 · coletado 19/10 18:02 primeiro registro

    Azure-hosted cluster scans for planted WordPress webshells tied to CVE-2018-14028, per F5 Honeynet March 2026 data

    ler a análise desta fonte

    F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes for PHP webshells already planted in predictable WordPress paths, such as /wp-content/uploads/*.php and the date-stamped /uploads/2021/02/. Of the top 30 source IPs, 29 sit in Microsoft Azure address space, which suggests a single operator running cloud-provisioned, multi-purpose scanning nodes. The scanning was indiscriminate, with WordPress paths sprayed at all application types. F5 offers three possible motives: harvesting the operator's own earlier webshells, hijacking other actors' webshells, or identifying compromised sites for later exploitation. The activity scaled from low-volume, geographically dispersed testing in January-February to concentrated higher-volume scanning in March.

    Technical Details

    • CVE-2018-14028 (CWE-434) requires admin credentials. A raw PHP file uploaded via the plugin upload function is not cleaned up after the ZIP extraction fails, so it remains reachable and gives RCE as the web server process.
    • Scanned filenames are generic (index.php, about.php, admin.php), suggesting a toolkit with standardized naming.
    • The same Azure IPs also probe CVE-2017-12932 (PHP deserialization) and generate tens of thousands of non-CVE events, indicating general-purpose reconnaissance toolkits.
    • The top source IP 74.235.238.88 produced 313 events in March, against a top source of 269 events in the prior period. Other ranges cited: 20.x, 4.204.x, 52.x, 40.x, 74.235.x, 172.190.x.
    • Wider March 2026 data: CVE-2024-4577 led with 16,271 attacks, CVE-2025-55182 (React Server Components, CVSS 10.0) rose to 4,290, and CVE-2020-15505 (MobileIron Core) entered at position 10 with 1,410. The US, Germany and Canada were the top attack sources.

    Remediation

    • Audit wp-content/uploads/, wp-content/upgrade/ and date-stamped subdirectories (especially /uploads/2021/02/) for PHP files. Treat any as a confirmed compromise.
    • Block PHP execution in upload and upgrade directories.
    • Update WordPress, enforce MFA and strong credentials on admin accounts, and remove unauthorized admins.
    • Deploy file integrity monitoring and WAF rules for PHP requests in upload paths, and log and rate-limit cloud-sourced requests to those paths.