Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.¹²³⁴⁵ On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.⁶⁷ Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.⁸⁹ For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.¹⁰¹¹

1. NVD CVE-2016-6662
2. CIS Multiple SMB Vulnerabilities
3. US-CERT TA18-106A Network Infrastructure Devices 2018
4. Cisco Blog Legacy Device Attacks
5. NVD CVE-2014-7169
6. Recorded Future ESXiArgs Ransomware 2023
7. Ars Technica VMWare Code Execution Vulnerability 2021
8. Mandiant Fortinet Zero Day
9. Wired Russia Cyberwar
10. OWASP Top 10
11. CWE top 25

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。