New Mirai Variant Targets WebSVN Command Injection Vulnerability (CVE-2021-32305)
Summary: Unit 42 observed in-the-wild exploitation of CVE-2021-32305, a critical command injection flaw in the open-source WebSVN code-browsing tool that was discovered and patched in May 2021, with attackers deploying Mirai DDoS malware variants within a week of a proof of concept appearing on June 26, 2021. The flaw stems from unescaped search queries passed to PHP's proc_open in versions prior to 2.6.1, and the attack script downloads and brute-forces Linux binaries for 12 different architectures, then connects to a command and control server on port 666.
Why it matters: A patch released in May was weaponized by late June, and the malware carries eight distinct DDoS attack types aimed at different targets - so any WebSVN instance still running a pre-2.6.1 version is a candidate for recruitment into a botnet whose operators are actively expanding their army.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-32305
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026