improper authentication Archives

Overview

CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS versions up to 10.3.2. This flaw allows remote attackers to bypass authentication via manipulation of a specific API parameter. The vulnerability is actively exploited in the wild, often chained with CVE-2026-105134, leading to post-exploitation activities such as webshell deployment and cryptominer installation.

Technical Analysis

Vulnerability: Improper Authentication (CWE-287).
Affected Software: Ahsay AhsayCBS up to version 10.3.2.
Affected Component: API component, specifically the checkSysPwd function within com/ahsay/obs/api/ApiStructsAction.java.
Attack Vector: Remote attackers can manipulate the random argument during API calls to bypass authentication.
CVSS 3.1 Score: 7.3 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This indicates a network-based attack, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
Exploitation: The exploit is public and actively used. It can be chained with CVE-2026-105134 for further compromise.
Observed Post-Exploitation: Deployment of webshells and XMRig cryptominer.

Detection

Monitor web server access logs for suspicious requests to the /obs/api/ApiStructsAction.java endpoint, particularly those manipulating the random parameter or exhibiting unusual authentication patterns (e.g., failed authentication followed by immediate success without valid credentials).
Look for unexpected file creations or modifications in web root directories, indicative of webshell deployment (e.g., .jsp, .php, .aspx files).
Monitor for new, unauthorized processes, especially those related to cryptomining (e.g., xmrig.exe, miner.exe) or unusual command-line executions originating from the AhsayCBS process.
Detect outbound network connections from AhsayCBS servers to known cryptomining pools or unusual C2 infrastructure.
Monitor for sustained high CPU utilization on AhsayCBS servers, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS API Improper Authentication Attempt

title: AhsayCBS API Improper Authentication Attempt
id: 902b7194-c71b-4d2a-a22a-1c3906a1a123
status: experimental
description: Detects suspicious access patterns to the AhsayCBS API endpoint related to CVE-2026-105133.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/obs/api/ApiStructsAction.java'
  condition: selection
level: medium

AhsayCBS Webshell Deployment in Web Root

title: AhsayCBS Webshell Deployment in Web Root
id: 7e7f8e1d-c3d9-4b1a-8b0c-0a1b2c3d4e5f
status: experimental
description: Detects creation of suspicious files (potential webshells) in the AhsayCBS web application directory.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|contains|all:
      - '\AhsayCBS\webapps\obs\'
    TargetFilename|endswith:
      - '.jsp'
      - '.aspx'
      - '.php'
  condition: selection
level: high

XMRig Cryptominer Process Execution

title: XMRig Cryptominer Process Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects common process names or command-line arguments associated with XMRig cryptominer activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    EventID: 1
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmdline:
    EventID: 1
    CommandLine|contains|all:
      - '--donate-level'
      - '-o'
  condition: 1 of selection_*
level: critical

Mitigations

Upgrade Ahsay AhsayCBS to version 10.3.4 or later immediately.
Implement network segmentation to restrict access to AhsayCBS servers from untrusted networks.
Deploy a Web Application Firewall (WAF) to detect and block suspicious API requests and webshell uploads.
Regularly audit AhsayCBS server logs for signs of compromise, including unauthorized file changes and process execution.
Ensure endpoint detection and response (EDR) solutions are deployed and configured to detect cryptomining activity and suspicious process behavior.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-105133
https://vuldb.com/cve/CVE-2026-105133
https://vuldb.com/submit/942688
https://vuldb.com/vuln/413350
https://vuldb.com/vuln/413350/cti
https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
https://www.huntress.com/blog/ahsaycbs-flaws-exploit
https://ltna.com.au/cyber

Indicators of Compromise

Type	Value	Description
SHA256	`05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034`	Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256	`481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21`	Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256	`4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d`	XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address	`51.195.127.124`	XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain	`imagefiles-backup.oss-ap-southeast-7.aliyuncs.com`	Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain	`xmr.kryptex.network`	XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL	`http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com`	Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1078 — Valid Accounts
T1505.003 — Web Shell
T1496 — Resource Hijacking
T1036.005 — Match Legitimate Resource Name or Location
T1564 — Hide Artifacts
T1543.003 — Windows Service
T1608.001 — Upload Malware
T1036.004 — Masquerade Task or Service
T1057 — Process Discovery
T1059.001 — PowerShell
T1571 — Non-Standard Port
T1059.003 — Windows Command Shell
T1071.001 — Web Protocols
T1105 — Ingress Tool Transfer
T1569.002 — Service Execution
T1124 — System Time Discovery

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,120 input / 1,803 output tokens ·

  Reviewed and approved by a human analyst before publication

Tag: improper authentication

CVE-2026-105133: AhsayCBS Improper Authentication Vulnerability Exploited