bingo!CMS auth bypass exploited in wild

10 October 2022 high vulnerability

Shift Tech's bingo!CMS contains an authentication bypass vulnerability allowing unauthenticated file upload; active exploitation confirmed by vendor.

Shift Tech Corporation's bingo!CMS, a content management system used in Japan, has been found to contain a critical authentication bypass vulnerability. The flaw allows attackers to bypass login authentication on certain CMS administrative functions and upload files containing malicious code by accessing specific URLs. According to the vendor, active exploitation of this vulnerability has been observed in the wild, prompting an urgent advisory from Japan's Information-technology Promotion Agency (IPA). Organizations running bingo!CMS are advised to apply the vendor-provided updates immediately. The vulnerability affects the administrative interface and could lead to complete system compromise through arbitrary file upload capabilities.

Detection guidance

Web Shell File Dropped via CMS Upload Vulnerability

ATT&CK T1505.003

Detects creation of script files (php/jsp/asp/aspx) by a web server process in a web-accessible directory, consistent with webshell upload via bingo!CMS auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Shell File Written by Web Server Process
id: 7e4c6c66-9058-5106-90b8-9445ebedf485
status: experimental
description: Detects a web server process (IIS, Apache, Tomcat, etc.) creating a new
  script file with an executable web extension, consistent with webshell upload following
  exploitation of an authentication bypass vulnerability such as the bingo!CMS flaw.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    TargetFilename|endswith:
    - .php
    - .jsp
    - .jspx
    - .asp
    - .aspx
  filter:
    TargetFilename|contains:
    - \deploy\
    - \update\
    - \install\
  condition: selection and not filter
falsepositives:
- Legitimate application deployment or CMS plugin/theme updates that write script
  files
- CI/CD pipelines pushing web application code directly to production web roots
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Shell Spawned from Web Server Process After Possible Webshell Execution

ATT&CK T1505.003

Detects command interpreters or scripting engines spawned as child processes of a web server, indicating possible webshell command execution following exploitation of a CMS authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Command Shell Spawned by Web Server Process
id: 80682767-b161-5f33-a57f-53041724bd63
status: experimental
description: Detects cmd.exe, powershell.exe, or other shell/script interpreters spawned
  as a child process of a web server binary, a strong indicator of webshell command
  execution after a CMS auth-bypass/upload exploit such as the bingo!CMS vulnerability.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    - \php.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bash.exe
  condition: selection
falsepositives:
- Legitimate administrative scripts triggered by web application scheduled maintenance
  tasks
- Custom CMS or plugin functionality that intentionally shells out to system utilities
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Outbound Connection Initiated by Web Server Process to Uncommon Port

ATT&CK T1505.003

Detects a web server process initiating outbound network connections to non-standard/high ports, consistent with reverse-shell or C2 callback behavior from a webshell placed via CMS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Making Outbound Connection to Uncommon Port
id: 35568a57-10ec-5b7a-b035-dc4db5baafa9
status: experimental
description: Detects a web server process (which normally only accepts inbound HTTP/S
  connections) initiating an outbound network connection to an uncommon port, which
  can indicate a webshell or backdoor established after exploitation of a CMS authentication
  bypass and file upload vulnerability such as bingo!CMS.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    Initiated: 'true'
  filter:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter
falsepositives:
- Web application legitimately calling external APIs or license servers over non-standard
  ports
- Health-check or monitoring agents integrated into the web server process
level: medium
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20221011-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free