GCVE-110-OSM-2020-6

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published December 27, 2020

Brandjacking attack impersonating Apache Maven Compiler Plugin (org.apache.maven.plugins:maven-compiler-plugin). Contains backdoor that downloads and executes arbitrary code from C2 server, targeting developer machines during Java compilation. Malicious code injected into execute() method of CompilerMojo.class. Contains hardcoded C2 server link (swmail.malware.index, IP: 112.11.168.47) and Java class loader capable of downloading and executing arbitrary code from the C2 server. Executes every time a developer compiles their Java project. Targets Unix-based machines running JVM. SHA1: 0a682f3304b6cea152aa5e2812d59850680265fb

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	maven-compiler-plugin	3.9.0 (affected)	—

References

Malicious maven package: maven-compiler-plugin

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON