FlagThis - #xss

Millions of WordPress websites face potential script injection attacks due to a critical vulnerability found in the Essential Addons for Elementor plugin, which is installed on over 2 million sites. The flaw, identified as CVE-2025-24752 with a high severity score of 7.1, allows attackers to execute reflected cross-site scripting (XSS) attacks. This is achieved by exploiting insufficient input sanitization within the plugin's password reset functionality, specifically through malicious URL parameters.

A fake WordPress plugin has also been discovered injecting casino spam, impacting website SEO. In a separate incident, cybersecurity researchers have flagged a malicious Python library on the PyPI repository, named 'automslc', which facilitates over 100,000 unauthorized music downloads from Deezer. The package bypasses Deezer's API restrictions by embedding hardcoded credentials and communicating with an external command-and-control server, effectively turning user systems into a botnet for music piracy.


References :

• bsky.app: Socket Security has discovered a malicious PyPI package that created a botnet to pirate songs from music streaming service Deezer The package was named automslc and had been downloaded over 100,000 since its release in 2019
• BleepingComputer: A malicious PyPi package named 'automslc'  has been downloaded over 100,000 times from the Python Package Index since 2019, abusing hard-coded credentials to pirate music from the Deezer streaming service.
• Talkback Resources: Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads [app] [mal]
• socket.dev: Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
• bsky.app: A malicious PyPi package named 'automslc'  has been downloaded over 100,000 times from the Python Package Index since 2019, abusing hard-coded credentials to pirate music from the Deezer streaming service.
• The Hacker News: Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads
• Sucuri Blog: Injecting malware via a fake WordPress plugin has been a common tactic of attackers for some time. This clever method is often used to bypass detection as attackers exploit the fact that plugins are not part of the core files of a WordPress site, making integrity checks more difficult.
• gbhackers.com: A critical security vulnerability in the Essential Addons for Elementor plugin, installed on over 2 million WordPress websites, has exposed sites to script injection attacks via malicious URL parameters. The flaw, tracked as CVE-2025-24752 and scoring 7.1 (High) on the CVSS scale, allowed attackers to execute reflected cross-site scripting (XSS) attacks by exploiting insufficient input sanitization in the plugin’s password reset
• bsky.app: Microsoft has removed two popular VSCode extensions, 'Material Theme - Free' and  'Material Theme Icons - Free,' from the Visual Studio Marketplace for allegedly containing malicious code.
• gbhackers.com: VS Code Extension with 9 Million Installs Attacks Developers with Malicious Code
• aboutdfir.com: VSCode extensions with 9 million installs pulled over security risks
• bsky.app: Microsoft has removed two VSCode theme extensions from the VSCode Marketplace for containing malicious code.
• Techzine Global: Visual Studio Code extensions with 9 million downloads removed for security risks

Classification:

• HashTags: #WordPress #XSS #PluginVulnerability
• Company: WordPress
• Target: WordPress websites, Deezer
• Product: WordPress
• Feature: Script Injection
• Malware: automslc
• Type: Bug
• Severity: Major

Cisco has confirmed the active exploitation of a decade-old vulnerability, CVE-2014-2120, affecting the WebVPN login page of its Adaptive Security Appliance (ASA) software. This cross-site scripting (XSS) vulnerability, originally disclosed in 2014, allows unauthenticated, remote attackers to launch XSS attacks against WebVPN users by enticing them to click a malicious link. The vulnerability stems from insufficient input validation, enabling attackers to inject malicious scripts into the victim's browser. Cisco's Product Security Incident Response Team (PSIRT) became aware of renewed exploitation attempts in November 2024, prompting an updated advisory urging customers to upgrade to a fixed software release immediately.

While Cisco strongly recommends upgrading to patched software versions, it's important to note that free updates will not be provided for vulnerabilities disclosed through Security Notices. Customers are advised to contact their usual support channels to obtain the necessary upgrades. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2014-2120 to its Known Exploited Vulnerabilities (KEV) catalog in November 2024, further highlighting the critical need for swift remediation. Organizations utilizing third-party support should consult their service providers to ensure compatibility with any applied fixes.


References :

• securityonline.info: Cisco Systems has issued an updated security advisory regarding CVE-2014-2120, a vulnerability affecting the WebVPN login page of Cisco Adaptive Security Appliance (ASA) Software.
• The Hacker News: Cisco updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA).
• malware.news: Cisco warns of continued exploitation of 10-year-old ASA bug, flaw in WebVPN login page exploited in the wild.
• securityaffairs.com: The ASA flaw CVE-2014-2120 is being actively exploited in the wild
• www.scworld.com: Cisco warns of continued exploitation of 10-year-old ASA bug
• Security Risk Advisors: Cisco ASA WebVPN Login Page Vulnerable to Cross-Site Scripting Attack
• sec.cloudapps.cisco.com: Cisco's security advisory details the vulnerability, its potential impact, and recommendations for mitigation.
• socradar.io: SOCRadar analysis of the Androxgh0st botnet and its use of the CVE-2014-2120 vulnerability.
• malware.news: Malware news article discussing the Androxgh0st botnet's utilization of the old Cisco ASA vulnerability.

Classification:

• HashTags: #Cisco #XSS #WebVPN
• Company: Cisco
• Target: Cisco ASA WebVPN users
• Product: ASA Software
• Feature: WebVPN login page
• Malware: CVE-2014-2120
• Type: Vulnerability
• Severity: Medium

A decade-old vulnerability in Cisco's Adaptive Security Appliance (ASA) software, CVE-2014-2120, is being actively exploited, prompting a renewed warning from Cisco. Initially deemed medium severity with a CVSS score of 4.3, the vulnerability allows Cross-site Scripting (XSS) attacks. Attackers can trick users into accessing malicious links, injecting scripts to gain unauthorized access. The Androxgh0st botnet is leveraging this flaw, alongside others, for broader malicious campaigns, including malware distribution. Cisco's Product Security Incident Response Team (PSIRT) observed active attacks as early as November 2024, leading to an updated advisory urging users to upgrade to patched versions.

The vulnerability stems from insufficient input validation in the ASA's WebVPN login page. While originally requiring user interaction to exploit, recent reports indicate a shift towards more sophisticated attack methods employed by the Androxgh0st botnet. Cisco emphasizes the importance of updating vulnerable ASA versions despite the vulnerability's age and relatively low initial severity rating. This incident highlights the ongoing threat posed by older, unpatched systems and the need for comprehensive security practices to mitigate risks from evolving cyber threats.


References :

• malware.news: Old Cisco ASA Vulnerability (CVE-2014-2120) Fuels Androxgh0st Botnet Activity
• sec.cloudapps.cisco.com: Cisco has issued a fresh warning regarding CVE-2014-2120, a decade-old vulnerability in its Adaptive Security Appliance (ASA).
• socradar.io: Old Cisco ASA Vulnerability (CVE-2014-2120) Fuels Androxgh0st Botnet Activity

Classification:

• HashTags: #Cisco #Androxgh0st #CVE
• Company: Cisco
• Target: Cisco ASA users
• Product: Cisco ASA
• Feature: Adaptive Security Appliance (A
• Malware: Androxgh0st
• Type: Vulnerability
• Severity: Medium