Disclaimer: This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable
Mentions the CVE; no further detail.
CVE-2021-27860 KEVPublic exploit High · 8.8 EPSS 39.7%
FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
FatPipe · WARP, IPVPN, and MPVPN software
Summary
The FatPipe WARP, IPVPN, and MPVPN software has an unrestricted file upload flaw (CWE-434) in its web management interface. A remote attacker with no authentication and no privileges can upload a file to any location on the filesystem, but this requires a user to interact with the attack (per the vector's UI:R component).
Official description · NVD
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
69.8 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 1
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 33 days after disclosure.
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 1PersistenceTA0003
Web Shell T1505.003
MITRE CTID mapping of the KEV entry · primary impact
CVE-2021-27860 is a vulnerability in the web management interface in FatPipe software. The vulnerability allowed APT actors to gain access to an unrestricted file upload function to drop a webshell for exploitation activity with root access, leading to elevated privileges and potential follow-on activity. Exploitation of this vulnerability then served as a jumping off point into other infrastructure for the APT actors.
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit
Detection
0 rules for this CVE · 35 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-27860 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportmedia.defense.gov
Reports are matched by finding the exact id CVE-2021-27860 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.