WebShellOrb

New Container, Old Code: Why the Incident Returned After Three Months

Two 1C-Bitrix sites shared the same web shell WebShellOrb after an attacker exploited multiple vulnerabilities in a legacy self-written application called appeal. The initial compromise occurred via an unauthenticated SQL injection in AppealModel::getReportData combined with JWT authentication bypass and hardcoded secrets. Logs were retained for only one month, so investigators could not trace the entry point and incorrectly concluded there was no persistence after restarting the container. The shared filesystem and single system user allowed the shell to be copied to the second site, while password hashes remained extractable through API methods. Even after password changes and container redeployment, the attacker regained access weeks later because the JWT secret, code flaws, and common storage were never addressed. The case demonstrates that redeploying containers without fixing root vulnerabilities in legacy code leaves systems exposed for months.