Aviatrix Controller RCE Exploited in the Wild to Deploy XMRig and Sliver
Summary
Wiz observed exploitation of Aviatrix Controller CVE-2024-50603, with XMRig and Sliver deployed. The unauthenticated RCE affects older versions; Wiz recommends patching, restricting public access, and investigating for compromise.
Key points
- CVE-2024-50603 is an unauthenticated command-injection flaw in Aviatrix Controller API endpoints; it allows remote command execution.
- Affected versions are earlier than 7.1.4191 and 7.2.x versions earlier than 7.2.4996.
- Wiz observed exploitation between January 7 and 10, 2025, after a public proof of concept appeared; observed instances were publicly exposed and vulnerable.
- Attackers deployed XMRig for cryptocurrency mining and Sliver backdoors; Wiz also saw failed attempts to install Mirai.
- Wiz found that 65% of cloud environments in its data with Aviatrix Controller had a lateral-movement path to administrative cloud control-plane permissions.
- Wiz reported no direct evidence of cloud lateral movement, though it considers enumeration of cloud permissions and potential data exfiltration likely.
- Wiz recommends upgrading, restricting public access where possible, and investigating for backdoors and lateral movement, including reviewing relevant cloud and network logs.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Command injection
- Severity
- Critical; CVSS 10.0
- Affected Versions
- Aviatrix Controller versions before 7.1.4191
- Aviatrix Controller 7.2.x versions before 7.2.4996
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Implement network restrictions to prevent public access to Aviatrix Controller.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 107[.]172[.]43[.]186 | Cryptocurrency mining pool IP address associated with the observed mining activity. |
| IPV4 | 83[.]222[.]191[.]91 | Mirai C2 server IP address. |
| IPV4 | 91[.]188[.]254[.]21 | Mirai C2 server IP address. |
| IPV4 | 91[.]193[.]19[.]109 | Sliver C2 server IP address. |
| SHA1 | 1ce0c293f2042b677cd55a393913ec052eded4b9 | SHA-1 hash identified as XMRig. |
| SHA1 | 41d589a077038048c4b120494719c905e71485ba | SHA-1 hash identified as Sliver. |
| SHA1 | 68d88d1918676c87dcd39c7581c3910a9eb94882 | SHA-1 hash identified as XMRig. |
| SHA1 | c4f63a3a6cb6b8aae133bd4c5ac6f2fc9020c349 | SHA-1 hash identified as XMRig. |
| SHA1 | c63f646edfddb4232afa5618e3fac4eee1b4b115 | SHA-1 hash identified as XMRig. |
| SHA1 | e10e750115bf2ae29a8ce8f9fa14e09e66534a15 | SHA-1 hash identified as Sliver. |
MITRE ATT&CK
T1059.004 · Unix ShellThe command-injection flaw allowed attackers to execute arbitrary OS commands on the controller.T1105 · Ingress Tool TransferObserved infections involved deployment of Sliver backdoors and XMRig.T1190 · Exploit Public-Facing ApplicationAttackers exploited the publicly exposed Aviatrix Controller vulnerability to gain initial access.T1496 · Resource HijackingAttackers abused compromised controllers to mine cryptocurrency using XMRig.T1505.003 · Web ShellSliver backdoors were deployed, reportedly to preserve access if the vulnerable controller was patched.
CVE
People
Malware
MiraiUpdated on 2025-01-19 to include additional investigation findings related to Sliver and Mirai infections.SliverUpdated on 2025-01-19 to include additional investigation findings related to Sliver and Mirai infections.XMRigthe threat actors exploiting this vulnerability are abusing their access to mine cryptocurrency using XMRig and deploy Sliver backdoors, presumably for persistence purposes (to avoid losing access if the infected
Vendors
Products
Aviatrix ControllerCVE-2024-50603 is a critical code execution vulnerability impacting Aviatrix Controller with the maximum CVSS score of 10.0. This command injection flaw allows unauthenticated attackers to execute arbitrary commands onAWSWhen deployed in AWS cloud environments, Aviatrix Controller allows privilege escalation by default, making exploitation of this vulnerability a high-impact risk. A simple proof-of-concept exploit has been published,Wizof this vulnerability a high-impact risk. A simple proof-of-concept exploit has been published, and Wiz Research has already observed exploitation in the wild resulting in cryptojacking and backdoor deployment.