Two campaigns targeting Selenium Grid’s default lack of authentication are underway, as threat actors are exploiting this vulnerability to deploy malicious payloads, including exploit kits, cryptominers, and proxyjackers.
Selenium Grid’s widespread use among developers, coupled with its default lack of security, makes it an attractive target for attackers seeking to compromise systems and gain unauthorized access.
The campaigns are leveraging Selenium Grid’s ability to execute code on remote machines to distribute and execute malicious software, posing a significant threat to organizations relying on this tool for testing and automation.
The misconfigured Selenium Grid instance allowed attackers to exploit a lack of authentication.
In a specific attack, the attackers injected a base64-encoded Python script into the “goog:chromeOptions” configuration, which was executed due to the specified Python3 binary in the WebDriver configuration.
Following the disabling of shell command history logging, the script proceeded to download a reverse shell script from a remote server.
The downloaded script, known as GSocket, established an encrypted TCP connection between the compromised system and a remote server, enabling the attackers to execute commands on the infected machine.
A malicious script “pl” retrieved from a command and control server performs various system checks and retrieves additional payloads depending on the architecture, and then stops specific Docker containers and sets the installation path.
According to Cado Security Labs, it retrieves IPRoyal Pawn and EarnFM payloads, likely used for selling the user’s internet bandwidth as a proxy service (IPRoyal Pawns) and for other malicious purposes.
Furthermore, “pl” contains a base64-encoded script “tm” that checks for root privileges and system information and installs Docker if missing. It then retrieves and configures Docker images for “traffmonetizer” and “WatchTower.”
The threat actor employed a multi-stage attack, starting with a base64-encoded Python script injected into Chrome, which decoded into a Bash script, prepared the system by creating directories, manipulating environment variables, and checking for existing processes.
It then downloaded an ELF binary packed with UPX and removed its header to evade detection.
The unpacked binary, written in Golang, attempted to exploit CVE-2021-4043 to gain root privileges.
It established connections to Tor nodes for C2 communication, dropped cryptomining binaries, set up cron jobs for persistence and also created temporary directories containing files related to the cryptomining process.
The SHC-compiled ELF binary, “Top,” is a Bash script that uses environment variables to determine its behavior.
If “ABWTRX” is set, it exits. If “AAZHDE” is not set, it modifies the PATH, sets up cleanup traps, terminates “perfctl” processes, and removes temporary files.
It then executes the “top” command to display system processes. This script was used in a recent campaign to exploit misconfigured Selenium Grid instances.
This attack highlights the importance of proper authentication and configuration for Selenium Grid to prevent unauthorized access and malicious activity.
