/
← Voltar ao feed
low exploit público

F5 analysis: 2024 CVE scanning surge driven by BotPoke scanner and a few German Contabo-hosted IPs

1 fonte(s) · 1 atualização(ões) · publicado 21/03/2025 14:08 · coletado há 1 dia

F5 Labs, using Efflux sensor telemetry, found that HTTP requests hitting its sensors rose from 5,125,557 in 2023 to 8,727,820 in 2024 (about 71%, or nearly 95% once normalized for sensor count). Most of the increase came from the BotPoke scanner, which looks for filenames associated with malware distribution sites. It was active mainly in May, August, September and October and moved its infrastructure from Lithuania to Hong Kong to the Netherlands. The November and December rise came from generic reconnaissance and information-disclosure scanning from a few IPs in Germany. Scanning for specific CVEs added little to the total volume.

Technical Details

  • Source countries driving the spikes were Lithuania (May, August, September), Hong Kong (October) and Germany (November, December).
  • In November 2024, 74% of traffic came from three IPs: 75.119.158.141, 109.205.183.151 and 194.163.160.246. In December, 213.136.70.221 replaced 109.205.183.151. All are in netblocks owned by Contabo, a German cloud hosting provider, and none has a negative reputation score. Shodan marks 75.119.158.141 as "compromised" and 194.163.160.246 resolves to ictel.com, so F5 judges the scanning likely originates at least partly from compromised servers.
  • The German IPs scanned mainly for reconnaissance and information disclosure, such as exposed credentials and data.
  • BotPoke is identified by its "BotPoke" User-Agent string. F5 says it is not necessarily malicious and its motivation is unclear.
  • A Ukrainian IP, 194.28.84.86 (Hostpro Ltd), generated about 261,234 events against F5's single Ukrainian sensor. It was a misconfigured Nagios HTTP check (check_http/v2.4.5 (nagios-plugins 2.4.5)) hitting / every 2 minutes.
  • CVE-2023-1389 accounted for only 155,524 events in 2024 despite being among the most scanned CVEs. CVE-2017-9841 accounted for 113,126 events despite a June 2024 spike.
  • ATT&CK: Vulnerability Scanning (T1595.002), Exploit Public-Facing Application (T1190).

Remediation

  • Scan the environment for vulnerabilities aggressively and patch high-priority ones as soon as feasible.
  • Use a WAF or similar tool to detect and stop web exploits.
  • Monitor anomalous outbound traffic to find devices participating in DDoS attacks.
  • Engage a DDoS mitigation service.

2 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2023-1389, CVE-2017-9841. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

    TP-Link Archer AX21 - Unauthenticated Command Injection

    This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

    CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA
  2. exploit-db.com · EDB-50702 ↗ · aplicação web · php · pub. 02/02/2022 não verificado

    PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)

    This script exploits CVE-2017-9841: PHPUnit's eval-stdin helper, when left reachable in a web-exposed vendor directory, executes any PHP code sent in an HTTP request body. The attacker needs only network access to a site that deployed PHPUnit (a dev dependency) publicly, with no login or user interaction. The tool checks several common framework layouts with a harmless test, then offers an interactive prompt that runs system commands as the web server user. It is a simple, working exploit that matches the CVE.

    CVE-2017-9841 · autor: souzo · explicação gerada por IA

Linha do tempo

  1. f5.com ↗ · pub. 21/03/2025 14:08 · coletado 19/10 18:02 primeiro registro

    F5 analysis: 2024 CVE scanning surge driven by BotPoke scanner and a few German Contabo-hosted IPs

    ler a análise desta fonte

    F5 Labs, using Efflux sensor telemetry, found that HTTP requests hitting its sensors rose from 5,125,557 in 2023 to 8,727,820 in 2024 (about 71%, or nearly 95% once normalized for sensor count). Most of the increase came from the BotPoke scanner, which looks for filenames associated with malware distribution sites. It was active mainly in May, August, September and October and moved its infrastructure from Lithuania to Hong Kong to the Netherlands. The November and December rise came from generic reconnaissance and information-disclosure scanning from a few IPs in Germany. Scanning for specific CVEs added little to the total volume.

    Technical Details

    • Source countries driving the spikes were Lithuania (May, August, September), Hong Kong (October) and Germany (November, December).
    • In November 2024, 74% of traffic came from three IPs: 75.119.158.141, 109.205.183.151 and 194.163.160.246. In December, 213.136.70.221 replaced 109.205.183.151. All are in netblocks owned by Contabo, a German cloud hosting provider, and none has a negative reputation score. Shodan marks 75.119.158.141 as "compromised" and 194.163.160.246 resolves to ictel.com, so F5 judges the scanning likely originates at least partly from compromised servers.
    • The German IPs scanned mainly for reconnaissance and information disclosure, such as exposed credentials and data.
    • BotPoke is identified by its "BotPoke" User-Agent string. F5 says it is not necessarily malicious and its motivation is unclear.
    • A Ukrainian IP, 194.28.84.86 (Hostpro Ltd), generated about 261,234 events against F5's single Ukrainian sensor. It was a misconfigured Nagios HTTP check (check_http/v2.4.5 (nagios-plugins 2.4.5)) hitting / every 2 minutes.
    • CVE-2023-1389 accounted for only 155,524 events in 2024 despite being among the most scanned CVEs. CVE-2017-9841 accounted for 113,126 events despite a June 2024 spike.
    • ATT&CK: Vulnerability Scanning (T1595.002), Exploit Public-Facing Application (T1190).

    Remediation

    • Scan the environment for vulnerabilities aggressively and patch high-priority ones as soon as feasible.
    • Use a WAF or similar tool to detect and stop web exploits.
    • Monitor anomalous outbound traffic to find devices participating in DDoS attacks.
    • Engage a DDoS mitigation service.