Wiz Adds Rules to Detect High-Risk Application Misconfigurations
Summary
Wiz announced rules to identify application misconfigurations that could enable remote code execution or information disclosure, with security-graph context to help prioritize risks and remediation.
Key points
- The rules target misconfigurations that may enable remote code execution or information disclosure, including issues that are not tied to a CVE.
- Examples include Consul script checks enabled, unauthenticated remote Jupyter access, and Redis exposed remotely without authentication.
- Wiz says the rules draw on real-world attacks, including misconfigured PostgreSQL containers infected with Kinsing cryptojacking malware.
- Recommended fixes include disabling Consul script checks, restricting Jupyter access and requiring authentication, and securing Redis with protected mode, authentication, or restricted network access.
- Wiz says security-graph correlation can surface combinations such as an internet-exposed, high-privilege machine with a vulnerable configuration.
Article Details
- Event Type
- Wiz announced new high-risk application misconfiguration rules and security graph correlations.
- Impact
- The rules identify application configurations that could enable remote code execution or information disclosure, helping customers prioritize and remediate risks. The article describes potential exposure to unauthorized access, lateral movement, cryptojacking, and data leaks; it does not report a new incident.
MITRE ATT&CK
Threat Actors
DreamBusThe article identifies the Dreambus botnet as having exploited Consul script-check misconfigurations to gain initial access, propagate internally, and hijack servers for cryptojacking.HeadCrabThe article identifies the HeadCrab botnet among those that have targeted misconfigured Redis instances for cryptojacking.
Malware
HinataBothave been misconfigured to allow unauthenticated command execution, including the recently discovered HinataBot botnet. Offensive security tools such as Metasploit include readily available modules for exploitingKinsingwhich these misconfigurations were exploited, such as misconfigured PostgreSQL containers infected with Kinsing cryptojacking malware. Besides the new critical RCE rules, we also added rules to identify high-severity
Vendors
Products
Apache Hadoop YARNobserved in GreyNoise for example, by querying for malicious scanners searching for publicly exposed Hadoop YARN ResourceManager instances that have been misconfigured to allow unauthenticated command execution,ConsulEnsure Hashicorp Consul does not allow arbitrary code execution Jupyter NotebookEnsure Jupyter Notebook does not allow remote unauthenticated access PostgreSQLabout real-world attacks in which these misconfigurations were exploited, such as misconfigured PostgreSQL containers infected with Kinsing cryptojacking malware. Besides the new critical RCE rules, we alsoRedisthe following scenario: a publicly exposed virtual machine (VM) in your cloud environment is hosting a Redis server, which has been misconfigured to allow unauthenticated access from any IP address. How long do youWiz Security Graphexcited to launch new high-risk application misconfiguration rules that are now correlated on the Wiz Security Graph, helping you protect against Remote Code Execution (RCE) and information disclosure.