Flax Typhoon Is Exploiting Five Bugs From 2015 to 2023. CISA Gave Agencies Three Days. Here Is the Free Check for Each One.
On October 8, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal agencies until October 11 to deal with them. Three days. Public reporting ties the exploitation to Flax Typhoon, the China-linked group run out of Integrity Technology Group, the same crew behind last week's advisory. The youngest of the five bugs is three and a half years old. The oldest two are eleven. This is an addendum to our October 9 post on that advisory, which named the advisory's own CVE but not these five. That was a gap, and this closes it.
Why a state crew bothers with eleven-year-old bugs
Because they still work. A nation-state operator with a zero-day budget still reaches for the cheapest door that opens, and the cheapest doors are the boxes nobody remembers owning: the DNS server a contractor set up in 2014, the FTP host that moves one nightly file, the Java app that was "temporary." None of these show up in a modern asset inventory because nobody has logged into them in years. If you run a small shop, a school district, a clinic or a county office, you are more likely to have one of these than a Fortune 500 is, not less.
CISA's three-day deadline is the tell. Normal KEV deadlines run about three weeks. Three days says somebody saw these used against something that mattered.
The five, and the free check for each
None of these checks costs anything. Each one runs on the box itself.
ISC BIND, [CVE-2015-5477](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2015-5477). A malformed TKEY query crashes the named daemon. That is a denial of service, not a break-in, but knocking out internal DNS is a good way to blind a network during an intrusion. Run named -v on every DNS server. Anything patched since mid-2015 is fixed. The real question is whether you have a BIND box nobody has patched since then.
ProFTPD, [CVE-2015-3306](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2015-3306). The mod_copy module lets an unauthenticated user copy files anywhere the FTP server can write, using the SITE CPFR and SITE CPTO commands. That turns into a web shell if the FTP server can write into a web root. Run proftpd -l and look for mod_copy. If it is loaded and you do not need it, turn it off with CopyEngine off inside an IfModule mod_copy.c block, or remove the module, then upgrade.
Apache Struts, [CVE-2016-3081](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2016-3081) (S2-032). Remote code execution through the method: prefix when Dynamic Method Invocation is turned on. Search your Struts config for struts.enable.DynamicMethodInvocation. If it is true, set it to false today, then upgrade Struts. If you do not know whether you run Struts, search your servers for struts2-core jar files. Java apps bundle it quietly.
ONLYOFFICE Docs, [CVE-2021-3199](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2021-3199). Path traversal through an image upload parameter, which can reach code execution. Check the Document Server version. Anything before 5.6.3 is exposed. ONLYOFFICE often comes bundled inside Nextcloud and other self-hosted suites, so check those too.
Strapi, [CVE-2023-22894](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2023-22894). Someone with admin-panel access can use query filters to read sensitive user fields, including password reset tokens. CISA notes it chains with CVE-2023-22621 for remote code execution, and that the affected versions may be end of life. Get the admin panel off the open internet, upgrade to a supported Strapi release, and rotate admin credentials and any secrets stored in it if it was ever exposed.
What our own edge saw: nothing, and that is not a pass
We checked every instrument we have, from July 1 to today: 60,197 edge blocks, 87,007 canary hits and 6,850 captures from the origin honeypot behind the edge. For the Struts and ONLYOFFICE exploit paths, zero. For Strapi, four canary hits matched an admin-users pattern, starting September 11. We looked at the actual requests before calling it anything. All four were generic hunting for .env files from one hosting network, not Strapi exploitation. We are not claiming a lead we did not have.
BIND and ProFTPD do not travel over the web at all, so our web edge cannot see them, by design. A zero from us on those two means nothing.
So read our zero for what it is: a measurement of our edge, not of yours. A quiet edge here does not mean a quiet edge anywhere else. If you run one of these five, check it this week whether or not anyone is talking about scanning.
If you only have an hour
Find out whether you run any of the five. That is the hard part. On Linux, check your package manager for bind, proftpd and onlyoffice, and search the filesystem for struts2-core. For anything internet-facing, a free external scan of your own address space will show open DNS, FTP and web ports you forgot about. Our October 9 post covers which of the advisory's 514 addresses still answer.
The original advisory write-up is at dugganusa.com/post/aa26-281a-flax-typhoon-integrity-tech-what-still-answers. CISA's catalog entries are the primary source for every date above.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=flax-typhoon-five-old-bugs-kev-three-day-deadline-free-checks
Comments