Exploit Public-Facing Application

Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)[1], standard services (like SMB[2] or SSH), network device administration and management protocols (like SNMP and Smart Install[3][4]), and any other applications with Internet accessible open sockets, such as web servers and related services.[5] Depending on the flaw being exploited this may include Exploitation for Defense Evasion.

If an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies.

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.[6][7]

ID: T1190
Sub-techniques:  No sub-techniques
Tactic: Initial Access
Platforms: AWS, Azure, GCP, Linux, Network, Windows, macOS
Data Sources: AWS CloudTrail logs, Application logs, Azure activity logs, Packet capture, Stackdriver logs, Web application firewall logs, Web logs
Contributors: Praetorian
Version: 2.2
Created: 18 April 2018
Last Modified: 21 October 2020

Procedure Examples

Name Description
APT28

APT28 has conducted SQL injection attacks against organizations' external websites.[8]

APT29

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.[9]

APT39

APT39 has used SQL injection for initial compromise.[10]

APT41

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.[11]

Axiom

Axiom has been observed using SQL injection to gain access to systems.[12][13]

BlackTech

BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.[14]

Blue Mockingbird

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.[15]

GOLD SOUTHFIELD

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.[16]

Havij

Havij is used to automate SQL injection.[17]

Night Dragon

Night Dragon has performed SQL injection attacks of extranet web servers to gain access.[18]

Rocke

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.[19][20]

Soft Cell

Soft Cell exploited a publicly-facing server to gain access to the network.[21]

SoreFang

SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.[22]

sqlmap

sqlmap can be used to automate exploitation of SQL injection vulnerabilities.[23]

Mitigations

Mitigation Description
Application Isolation and Sandboxing

Application isolation will limit what other processes and system features the exploited target can access.

Exploit Protection

Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

Network Segmentation

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Privileged Account Management

Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

Update Software

Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.

Vulnerability Scanning

Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.[6]

Detection

Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.

References