bingo!CMS auth bypass exploited in wild

Published10 October 2022 Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Attackers are exploiting an authentication bypass in bingo!CMS to upload malicious files without logging in, per the vendor.

Sourceipa.go.jp — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

IPA and JVN have issued an alert for bingo!CMS, a content management system from Shift Tech Inc., warning of an authentication bypass vulnerability in part of its administrative functionality. By accessing a specific URL, an attacker can bypass login authentication and upload a file containing malicious code to the affected management interface, potentially leading to remote code execution on the server.

The vendor has confirmed that this vulnerability is being actively exploited in the wild, and users are urged to apply the developer-provided update as soon as possible. The vulnerability has been scored 7.5 (Important/警告) under CVSS v3 and 5.0 under CVSS v2, reflecting a network-exploitable, low-complexity attack path that requires no authentication.

Detection guidance

bingo!CMS Authentication Bypass Exploitation Attempt

ATT&CK T1190 · status experimental · needs proxy logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of HTTP requests to bingo!CMS administrative endpoints that bypass authentication via specific URL path patterns, indicating exploitation of CVE in bingo!CMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: bingo!CMS Authentication Bypass Exploitation Attempt
description: Detects HTTP requests to bingo!CMS administrative interface using authentication
  bypass vulnerability. Matches requests to known vulnerable URL paths in bingo!CMS
  that allow unauthenticated access to file upload functionality.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection_cms_auth_bypass:
    c-uri|contains:
    - /admin
    - /management
    c-uri|endswith:
    - .php
    - .asp
    - .aspx
    cs-method: GET
  filter_legitimate_auth:
    cs-cookie|contains: session
  condition: selection_cms_auth_bypass and not filter_legitimate_auth
falsepositives:
- Legitimate administrator access without session cookies (e.g., first login attempt)
- Security scanners probing CMS endpoints
level: high
id: 64d7c006-1a31-5fd0-85fa-ecfc81f61077
status: experimental
author: Vorant

bingo!CMS Malicious File Upload to Administrative Directory

ATT&CK T1190 · status experimental · needs proxy logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of file uploads to bingo!CMS management interface following authentication bypass, with executable or script file extensions indicative of webshell deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: bingo!CMS Malicious File Upload to Administrative Directory
description: Detects POST/PUT requests uploading executable or script files to bingo!CMS
  administrative directories, typically following authentication bypass exploitation.
  Targets common webshell extensions and upload endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
detection:
  selection_upload_request:
    cs-method:
    - POST
    - PUT
    c-uri|contains: upload
  selection_webshell_ext:
    c-uri|endswith:
    - .php
    - .php3
    - .php4
    - .php5
    - .phtml
    - .asp
    - .aspx
    - .jsp
    - .jspx
    - .sh
  filter_legitimate_cms_update:
    cs-user-agent|contains:
    - bingo!CMS
    - official-updater
  condition: (selection_upload_request and selection_webshell_ext) and not filter_legitimate_cms_update
falsepositives:
- Legitimate content updates by administrators uploading plugins or themes in PHP
- Software update mechanisms from trusted vendors
level: high
id: 821820e8-896e-5d46-846a-dea66d2fafab
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20221011-jvn.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs