VORANT. Threat Intelligence Research Create a free account

bingo!CMS auth bypass exploited in wild

Published Vorant ratingelevated vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Shift Tech's bingo!CMS contains an authentication bypass vulnerability allowing unauthenticated file upload; active exploitation confirmed by vendor.

Sourceipa.go.jp — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

Shift Tech Corporation's bingo!CMS, a content management system used in Japan, has been found to contain a critical authentication bypass vulnerability. The flaw allows attackers to bypass login authentication on certain CMS administrative functions and upload files containing malicious code by accessing specific URLs. According to the vendor, active exploitation of this vulnerability has been observed in the wild, prompting an urgent advisory from Japan's Information-technology Promotion Agency (IPA). Organizations running bingo!CMS are advised to apply the vendor-provided updates immediately. The vulnerability affects the administrative interface and could lead to complete system compromise through arbitrary file upload capabilities.

Related reporting

Detection guidance

Web Shell File Dropped via CMS Upload Vulnerability

ATT&CK T1505.003 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects creation of script files (php/jsp/asp/aspx) by a web server process in a web-accessible directory, consistent with webshell upload via bingo!CMS auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Shell File Written by Web Server Process
id: 7e4c6c66-9058-5106-90b8-9445ebedf485
status: experimental
description: Detects a web server process (IIS, Apache, Tomcat, etc.) creating a new
  script file with an executable web extension, consistent with webshell upload following
  exploitation of an authentication bypass vulnerability such as the bingo!CMS flaw.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    TargetFilename|endswith:
    - .php
    - .jsp
    - .jspx
    - .asp
    - .aspx
  filter:
    TargetFilename|contains:
    - \deploy\
    - \update\
    - \install\
  condition: selection and not filter
falsepositives:
- Legitimate application deployment or CMS plugin/theme updates that write script
  files
- CI/CD pipelines pushing web application code directly to production web roots
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Shell Spawned from Web Server Process After Possible Webshell Execution

ATT&CK T1505.003 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects command interpreters or scripting engines spawned as child processes of a web server, indicating possible webshell command execution following exploitation of a CMS authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Command Shell Spawned by Web Server Process
id: 80682767-b161-5f33-a57f-53041724bd63
status: experimental
description: Detects cmd.exe, powershell.exe, or other shell/script interpreters spawned
  as a child process of a web server binary, a strong indicator of webshell command
  execution after a CMS auth-bypass/upload exploit such as the bingo!CMS vulnerability.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    - \php.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bash.exe
  condition: selection
falsepositives:
- Legitimate administrative scripts triggered by web application scheduled maintenance
  tasks
- Custom CMS or plugin functionality that intentionally shells out to system utilities
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Outbound Connection Initiated by Web Server Process to Uncommon Port

ATT&CK T1505.003 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server process initiating outbound network connections to non-standard/high ports, consistent with reverse-shell or C2 callback behavior from a webshell placed via CMS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Making Outbound Connection to Uncommon Port
id: 35568a57-10ec-5b7a-b035-dc4db5baafa9
status: experimental
description: Detects a web server process (which normally only accepts inbound HTTP/S
  connections) initiating an outbound network connection to an uncommon port, which
  can indicate a webshell or backdoor established after exploitation of a CMS authentication
  bypass and file upload vulnerability such as bingo!CMS.
references:
- https://www.ipa.go.jp/security/
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \java.exe
    - \php-cgi.exe
    Initiated: 'true'
  filter:
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  condition: selection and not filter
falsepositives:
- Web application legitimately calling external APIs or license servers over non-standard
  ports
- Health-check or monitoring agents integrated into the web server process
level: medium
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/20221011-jvn.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs