Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

openeclass

The exploit targets a critical Remote Code Execution (RCE) vulnerability in Open eClass version 3.15, identified as CVE-2024-26503. The vulnerability arises from an unrestricted file upload flaw in the administrative badge icon upload functionality, allowing an authenticated user to upload a malicious PHP web shell disguised as an icon file. Once uploaded, the attacker can execute arbitrary system commands via HTTP GET requests to the web shell endpoint. The exploit script automates this process by first authenticating with valid user credentials, uploading the PHP shell, and then providing an interactive command execution interface. The shell code is minimalistic, leveraging PHP's shell_exec function to execute commands passed via the 'cmd' GET parameter. The exploit requires valid login credentials, indicating that the attacker must have some level of authorized access, but no additional privilege escalation is necessary. The code is straightforward, well-structured, and uses Python's requests library for HTTP interactions, demonstrating moderate sophistication suitable for rapid exploitation. Detection can focus on anomalous POST requests to the badge upload endpoint with PHP files, unusual GET requests to the execute.php shell with command parameters, and unexpected creation of execute.php files in badge_templates directories. Forensics would reveal web shell artifacts and suspicious command execution logs. Overall, this exploit leverages a common but critical web application flaw—unrestricted file upload combined with insufficient input validation—to achieve full remote code execution on the server hosting Open eClass 3.15.

Original Source

Raw Exploit Code

CVE Details: CVE-2024-26503

Open eClass 3.15 - RCE

Threats Tagged 'multiple platforms'

Filter Threats

Threats Tagged 'multiple platforms'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Lead Pen Test Professional