Old vulnerabilities in Apache Struts, BIND, and ProFTPD targeted by attackers

The US cybersecurity agency CISA added five vulnerabilities to its “Known Exploited Vulnerabilities” (KEV) catalog late last week. These are partly very old vulnerabilities that attackers are currently targeting.

In parallel, the agency published a warning an attack campaign attributed to Chinese actors , in which all five vulnerabilities are listed as being exploited to spy on sensitive information. The new entries in CISA’s KEV catalog have otherwise not yet received any further attention. The oldest vulnerabilities date back to 2015. For example, in long-unupdated versions of ProFTPD, attackers can read or write arbitrary files from the network using the commands “site cpfr” and “site cpto” ( CVE-2015-3306 , CVSS2 10.0 , Risk “ critical ”). The mod_copy module of ProFTPD 1.3.5 was affected – the current version is 1.3.9d or release candidate 1.3.10rc4.

In 2015, a security vulnerability existed in the BIND DNS server that allowed attackers to provoke denial-of-service conditions from the network ( CVE-2015-5477 , CVSS 7.5 , Risk “ high ”). A vulnerability in Apache Struts from 2016 can be exploited by malicious actors with enabled “Dynamic Method Invocation” to inject and execute arbitrary program code ( CVE-2016-3081 , CVSS 8.1 , Risk “ high ”). A path traversal vulnerability in OnlyOffice Docs, with JWT enabled, also allows code injection from the network ( CVE-2021-3199 , CVSS 9.8 , Risk “ critical ”). In Strapi, on the other hand, attackers can read sensitive information in the admin panel – in some cases, in addition to password hashes, also password reset tokens. CISA points out that chaining with vulnerability CVE-2023-22621 can lead to the execution of injected malicious code ( CVE-2023-22894 , CVSS according to CISA 7.2 , Risk “ high ”).

For some affected software, manufacturers still provide updates to fix the vulnerabilities. In some cases, however, the affected software has reached the end of its product lifecycle. Where migration to a secured version is not possible, organizations should cease using the software. CISA has set a deadline of only three days for US federal agencies, which already expired on October 11.

It is not unusual for attackers to target old vulnerabilities. In mid-April this year, for example, cyberattacks on a 17-year-old Excel vulnerability became known.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.