FBI Warning: Cybercriminals Abusing Zero-Day in FatPipe VPN

The flash alert

• The flaw dates back to May and was exploited in the wild to breach target networks. 
• The zero-day flaw abused in these attacks impacted all FatPipe MPVPN, IPVPN, and WARP device software versions released before the latest ones, 10.2.2r44p1 and 10.1.2r60p93.
• The flaw allowed the APT group to obtain access to an unrestricted file upload function to drop a webshell with root access for exploitation. It led to privilege escalation and further activities. 
• After compromising exposed FatPipe devices, the attackers used them for lateral movement inside the networks.

The zero-day flaw

• It occurs due to a lack of input and validation checking for specific HTTP requests on a vulnerable device. 
• This vulnerability could be exploited by sending a modified HTTP request to the device.
• Successful exploitation could allow a remote attacker to upload a file to the desired location on the filesystem on a vulnerable device.
• The flaw doesn't have a CVE ID at present, however, it’s been fixed in a security advisory, FPSA006.

Preventive actions