Surge in attacks exploiting old ThinkPHP and ownCloud flaws

Increased hacker activity has been observed in attempts to compromise poorly maintained devices that are vulnerable to older security issues from 2022 and 2023. Threat monitoring platform GreyNoise is reporting spikes in actors leveraging CVE-2022-47945 and CVE-2023-49103 that affect ThinkPHP Framework and the open-source ownCloud solution for file sharing and syncing. Both vulnerabilities have critical severity and can be exploited to execute arbitrary operating system commands or to obtain sensitive data (e.g. admin password, mail server credentials, license key). The first vulnerability is a local file inclusion (LFI) issue in the language parameter of ThinkPHP Framework before 6.0.14. An unauthenticated remote attacker can leverage it to execute arbitrary operating system commands in deployments where the language pack feature is enabled. Akamai reported last summer that Chinese threat actors have been leveraging the flaw since October 2023 in narrow-scope operations. According to threat monitoring platform GreyNoise, CVE-2022-47945 is under high-volume exploitation right now, with attacks launched from a growing number of source IPs. "GreyNoise has observed 572 unique IPs attempting to exploit this vulnerability, with activity increasing in recent days," warns the bulletin. This is despite its low Exploit Prediction Scoring System (EPSS) rating of 7% and the flaw not being included in CISA's Known Exploited Vulnerabilities (KEV) catalog. The second vulnerability affects...