T1190_exploit-public-facing-application

T1190 Exploit Public-Facing Application

High-Level Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers. Depending on the flaw being exploited, this may also involve Exploitation for Defense Evasion or Exploitation for Client Execution.

If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.

Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.

For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.

Kill Chain Phase

• Initial Access (TA0001)

Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows

What to Check

• Identify if Exploit Public-Facing Application technique is applicable to target environment
• Check Containers systems for indicators of Exploit Public-Facing Application
• Check ESXi systems for indicators of Exploit Public-Facing Application
• Check IaaS systems for indicators of Exploit Public-Facing Application
• Verify mitigations are bypassed or absent (8 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Exploit Public-Facing Application by examining the target platforms (Containers, ESXi, IaaS).

2. Assess Existing Defenses: Review whether mitigations for T1190 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1048 Application Isolation and Sandboxing

Application isolation will limit what other processes and system features the exploited target can access.

M1037 Filter Network Traffic

Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.

M1030 Network Segmentation

Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

M1016 Vulnerability Scanning

Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.

M1026 Privileged Account Management

Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

M1050 Exploit Protection

Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

M1035 Limit Access to Resource Over Network

Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.

M1051 Update Software

Update software regularly by employing patch management for externally exposed applications.

Detection

Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)

Risk Assessment

CWE Categories

References

• CWE top 25
• CIS Multiple SMB Vulnerabilities
• Ars Technica VMWare Code Execution Vulnerability 2021
• Recorded Future ESXiArgs Ransomware 2023
• Wired Russia Cyberwar
• Mandiant Fortinet Zero Day
• NVD CVE-2016-6662
• NVD CVE-2014-7169
• Cisco Blog Legacy Device Attacks
• OWASP Top 10
• US-CERT TA18-106A Network Infrastructure Devices 2018
• Atomic Red Team - T1190
• MITRE ATT&CK - T1190