Operation Shadow Breach

TechNova is using Apache web server version 2.4.49. CVE-2021-41773: Path traversal and RCE Path Traversal is a vulnerability that allows an attacker to view unauthorized files on a server by using special characters such as ../ MITRE ATT&CK Technique ID: T1190 Open ports and services: Port 21: FTP Port 22: SSH Port 80: HTTP Port 139: samba Port 443: HTTPS Port 445: samba Port 3306: mysql port 8080: http

Things that can be used: SSH can be used to connect remotely to the server, FTP and samba can be exploited, and mySQL is a database which should not have unsecured open ports, as well as port 8080, which is used for http.

Potential Logins: sjohnson@technova.local sarah.johnson.technova mchen@technova.local arodriguez@technova.local admin Technova2024! Encrypted Password: Cqrwt-Lxuunlc-Yajlcrlju-Knbc-Proc Decrypted Password: Think-Collect-Practical-Best-Gift Login credentials: arodriguez Think-Collect-Practical-Best-Gift

I looked through the TechNova website pages for potential information about their security and systems that are being used. I found that they had a server running Apache 2.4.49. I then did research about known vulnerabilities, and found one that allowed for directory traversal and access to the root directory. I then looked through the website and found a list of open ports on the server as well as potential log in information.

If I was TechNova's security team, the stage that an intrusion would've been detected was after gaining access using SSH, due to the repeated login attempts and successful login using the same password on multiple accounts. The way that this would've been detected was repeated SSH login attempts coming from a foreign IP address during non-business hours.

I think that the severity of the Apache 2.4.49 vulnerability is an 8/10. I think this because it got a 7.5 for its CVSS base score and because this allows for path traversal and access to the root directory without needing authentic credentials to access the root directory.

I think TechNova decided to keep the vulnerable server running instead of patching immediately was because it was known that it was vulnerable and they separated it from other servers on the network and isolated it. I disagree with TechNova's decision because while it is convenient for the business, it isn't worth the large security trade-off of having a server that vulnerable. I think this because the vulnerability gives attackers an easy route into the system root without any way to detect suspicious activity until they gain access to the server. Some safety measures that TechNova put in place to reduce risk while keeping the vulnerable server running was putting it on its own separate subnet, making it accessible via SSH without using the default SSH port, and separating it from the rest of the network. These compensating controls are not adequate, I would recommend using stronger passwords, not using a specific naming scheme for usernames, and closing unused ports on the server. I think it is unethical for a company to knowingly run vulnerable systems because it makes a breach more likely to happen, which affects the workers, customers, and also stakeholders. This could lead to huge amounts of personal data being stolen and the company could face huge consequences. This would be acceptable to run if they didn't have it listed as an operational server on their page with information on how its configured and that it is running a vulnerable version of Apache. I think TechNova's leadership team should face legal consequences if a breach were to happen because they have sensitive information about the vulnerable server and its configuration on a public website which allows for attackers to have an easier time gathering information about the vulnerable server and if they hadn't mentioned that they have a vulnerable system then no one would know without doing active reconnaissance work on their network.