DevOps協作平臺Atlassian Confluence已知漏洞遭到利用，慘遭勒索軟體Cerber攻入
· 2024-04-18
研究人員揭露最近一波勒索軟體Cerber攻擊行動，對方入侵受害組織的管道，就是DevOps協作平臺Atlassian Confluence已知漏洞CVE-2023-22518
Cado
研究人員發現，使用勒索軟體Cerber從事攻擊行動的駭客，3月下旬利用DevOps協作平臺Atlassian Confluence已知漏洞CVE-2023-22518，目的是對受害組織植入Linux版勒索軟體程式。
資安業者Cado發現，3月19日出於經濟動機的駭客企圖利用上述漏洞存取Confluence實體，從而濫用管理員帳號於受害主機部署Effluence Web shell外掛程式，從而藉由網頁介面執行任意命令，下載並執行Cerber的有效酬載。
CVE-2023-22518是身分驗證不當漏洞，一旦攻擊者利用，就有機會在未經授權的情況下重設Confluence伺服器組態，並建立新的管理員帳號，並濫用該帳號執行管理員工作，從而接管系統，導致機密性、完整性、可用性喪失，CVSS風險評分為9.1，Atlassian於去年10月發布新版軟體予以修補。
研究人員指出，由於在預設組態中，Confluence伺服器以低權限使用者（confluence）執行，因此該勒索軟體能加密的檔案有限，僅為該帳號能夠存取的資料。但若是攻擊者能夠取得較高權限，加密檔案的範圍將會擴大。
值得留意的是，駭客利用這項漏洞散布Cerber已非首例。去年11月，資安業者Rapid7發現該勒索軟體的攻擊行動，對方其中一個利用的漏洞就是CVE-2023-22518。
熱門文章
GAT Expo Puerto Rico Will Pulse with the New Era of Gaming in the Caribbean
Marketing
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
PropellerAds Positions Itself as a Go-To Traffic Source for iGaming Advertisers Ahead of a High-Demand Season
Marketing
Gaming & Technology Expo Makes a Powerful Entrance in CDMX
Marketing
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
DB Gaming Is One of Asia’s Top-Tier Game Solution Providers, Recognized as a Pioneer in the Asian Gaming Industry.
Marketing
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
What’s on the SBC Summit Conference Agenda in 2026?
Marketing
Super PAC Raises $48 Million: Sports Betting Forces Ramp Up Political Push
Regulation
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
Manila delivers: Highlights from SiGMA Asia 2026
Southeast Asia
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
SBC Summit Canada to Make Player Safety a Key Pillar of 2026 Agenda
Marketing
