Baget: Exploit 2021

Compromised continuous integration (CI) environments provide attackers with a launchpad to move laterally into production cloud servers. Mitigating the Dependency Confusion Flaw

Attackers can gain a persistent foothold on the hosting environment.

A public Proof-of-Concept (PoC) is available on Exploit-DB, demonstrating how to automate the upload and execution process. 2022 Top Routinely Exploited Vulnerabilities - CISA

Despite being patched in 2022, many unpatched or legacy systems remain vulnerable. The exploit is reliable, easy to execute, and has been incorporated into many post-exploitation frameworks and malware families (including some referred to as "BAGET"). baget exploit 2021

: Leaked internal chat logs (ContiLeaks) revealed that Baget was a core developer proficient in C/C++ . He was credited with finishing the code for a specific backdoor in late 2020, which served as a precursor to attacks in 2021.

The exploit allows an attacker to bypass file type restrictions to achieve the following:

is a memory corruption vulnerability in Microsoft's Internet Explorer that carries a CVSS score of 8.8, indicating high severity. This flaw, which was patched by Microsoft, could be triggered when a victim viewed a specially crafted website, allowing an attacker to execute arbitrary code on the target machine. By early 2021, researchers discovered that the RIG EK had already incorporated an exploit for this vulnerability, making it a key component of its attack arsenal. 2022 Top Routinely Exploited Vulnerabilities - CISA Despite

The Baget stub creates a scheduled task named WindowsUpdateService that fires every 15 minutes. It also modifies the CurrentVersion\Run registry key. From there, the injected RAT downloads additional modules – keyloggers, clipboard stealers, or even a ransomware component.

For developers and system administrators using this software, immediate action is required to secure the environment:

auditctl -a always,exit -S execve -F path=/usr/bin/pkexec -k pkexec_monitor He was credited with finishing the code for

Automated web hooks can transmit environmental variables, system passwords, and database connection strings to command-and-control servers.

[Attacker] │ ▼ (Forged HTTP POST Request to push package) ┌──────────────────────────────────────────────┐ │ Vulnerable BaGet API Endpoints │ │ - /v3/index.json / Allow Anonymous Pushes │ └──────────────────────┬───────────────────────┘ │ ▼ (Bypasses weak verification) ┌──────────────────────────────────────────────┐ │ Arbitrary File / Package Storage (RCE) │ └──────────────────────────────────────────────┘ Technical Mechanics of the Attack

The exploit involves the following steps:

While the Budget and Expense Tracker System may appear to be a small application, the impact of this RCE is significant:

Stay patched, stay vigilant, and never trust your email server.