- ACCELLION FILE TRANSFER APPLIANCE INSTALL
- ACCELLION FILE TRANSFER APPLIANCE PATCH
- ACCELLION FILE TRANSFER APPLIANCE FULL
To include the signatures mentioned in this article in your policy – make sure to enable SQL-Injection and Trojan/Backdoor/Spyware attack types. As Accellion File Transfer Appliance (FTA) is approaching its End of Life on April 30th, 2021, you may be looking for an alternative to take its place.
In addition, we have released dedicated attack signatures to provide coverage against the DEWMODE WebShell which was used extensively in this attack, in the form of the following signatures:Ģ00019140 - DEWMODE WebShell upload attemptĢ00019141 - DEWMODE WebShell request attempt (2)Ģ00019142 - Generic eval WebShell upload attemptĢ00019144 - DEWMODE WebShell request attempt (1) The SQL injection payloads have been tested against F5 WAF and found to be mitigated by the following attack signatures:Ģ00002550 - SQL-INJ "end-quote UNION" (Parameter)Ģ00000073 - SQL-INJ "UNION SELECT" (Parameter)Ģ00002736 - SQL-INJ 'UNION SELECT (Parameter)Ģ00002441 - SQL-INJ "reverse()" (Parameter)
ACCELLION FILE TRANSFER APPLIANCE INSTALL
This page is used to install a simple eval WebShell, which is then used to upload the more sophisticated DEWMODE WebShell.Īdvanced WAF customers under any supported version are already protected against this vulnerability as exploitation attempts will be detected by SQL Injection and Command Execution attack signatures. These payload help the attacker extract a special key, which is subsequently used to interact with a page called sftp_account_edit.php. The payloads as shown in this attack are:
ACCELLION FILE TRANSFER APPLIANCE FULL
However, as it is a challenging task for organizations, many of them are failing to implement the required diligent steps to protect their digital assets.įireEye has published a full forensic breakdown of the attack by threat actor UNC2546:įrom the report is seems the attack vector uses the SQLI vulnerability ( CVE-2021-27101) to install the DEWMODE WebShell. Ideally, sensitive file sharing systems should be kept sufficiently restricted and network moderated – away from the access of public Internet.
ACCELLION FILE TRANSFER APPLIANCE PATCH
The vulnerabilities were discovered in December 2020 and a patch was issued quickly by Accellion on December 23rd 2020. IT Biztonság címke: Accellion File Transfer Appliance. Recently it’s been reported that multiple threat actors are successfully exploiting newly discovered CVEs found in Accellion FTA (File Transfer Appliance).Īccellion FTA is an enterprise grade secure file transfer solution – it is based on PHP and supports on-premise, private cloud or hosted configurations.
0 kommentar(er)
