Array AG series remote access appliances contain a command injection flaw in DesktopDirect
Array AG series remote access appliances contain a command injection flaw in DesktopDirect; exploitation observed in Japan since August 2025, deploying PHP webshells.
Sourceipa.go.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Array Networks' AG series remote access products contain a command injection vulnerability in the DesktopDirect feature that allows unauthenticated attackers to execute arbitrary commands. Array Networks released patches in May 2025, but active exploitation has been observed in Japan since August 2025. Attackers have been confirmed deploying PHP webshells to compromised systems. The Japan Information-technology Promotion Agency (IPA) warns that attacks may escalate and urges immediate patching. Organisations using Array AG products are advised to review logs for indicators of compromise, preserve logs before patching (as system restart may cause log loss), and report suspected compromises to IPA. As a workaround, disabling the DesktopDirect feature mitigates the vulnerability. The advisory notes that associated IP addresses may belong to legitimate security research entities, and one listed address was later identified as belonging to an overseas security organisation and removed from the advisory.
Detection guidance
Web Server Process Spawning Shell Interpreter (Possible Command Injection)
A behavioural hunt for the technique in general.
Detects a web/application server process (e.g. httpd, php-fpm, nginx) spawning a shell interpreter, consistent with exploitation of a command injection vulnerability such as the Array AG DesktopDirect flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell Interpreter
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- httpd
- apache2
- nginx
- php-fpm
- php
shell:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
condition: selection and shell
falsepositives:
- Legitimate CGI scripts or application code intentionally invoking shell commands
via system()/exec()
- Custom web application health-check or deployment scripts that shell out from the
web server user context
level: high
tags:
- attack.t1190
- attack.t1059
id: fc25c3ce-3534-564b-99c1-6a2a114acac8
status: experimental
author: Vorant
PHP Webshell File Written by Web Server Process
A behavioural hunt for the technique in general.
Detects creation of a new PHP file by a web/application server process, consistent with webshell deployment following successful exploitation of a command injection vulnerability like the Array AG DesktopDirect flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Created By Web Server Process
logsource:
category: file_event
product: linux
detection:
selection:
Image|contains:
- httpd
- apache2
- nginx
- php-fpm
TargetFilename|endswith: .php
condition: selection
falsepositives:
- Legitimate application deployment or update processes that write PHP files as part
of normal operation
- CMS or plugin auto-update mechanisms running under the web server account
level: high
tags:
- attack.t1505.003
- attack.t1190
id: c9b6b4c1-6dad-5399-ad76-950a4c9a923c
status: experimental
author: Vorant
Reconnaissance Commands Executed by Web Server Process
A behavioural hunt for the technique in general.
Detects common post-exploitation reconnaissance commands (id, whoami, uname, wget, curl) executed with a web server or PHP process as parent, indicating command execution via an injected webshell or command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon Commands Spawned From Web Server Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- httpd
- apache2
- nginx
- php-fpm
- php
cmds:
CommandLine|contains:
- whoami
- 'id '
- uname
- 'wget '
- 'curl '
- /etc/passwd
condition: selection and cmds
falsepositives:
- Legitimate monitoring or health-check scripts invoked from the web server context
that call system utilities
- Administrative tooling that shells out from a CGI or PHP handler for diagnostic
purposes
level: medium
tags:
- attack.t1059
- attack.t1190
id: db1f8e43-e732-52ec-a235-1dd937690596
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251208.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs