CVE-2017-5638 Apache Struts vulnerability is the root cause behind Equifax data breach
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) | |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin CVE-2017-9805 is an unsafe deserialization vulnerability in the REST plugin of Apache Struts 2, which uses the XStream library to deserialize XML request payloads without any type filtering. An attacker triggers it by sending a crafted XML payload to an endpoint handled by the REST plugin, causing the payload to be deserialized into arbitrary objects. Successful exploitation yields remote code execution on the server with the privileges of the web application, typically enough to fully take over the host. Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 are affected, including products from Cisco and NetApp that bundle vulnerable Struts versions. The flaw has a public proof-of-concept exploit, is on CISA's Known Exploited Vulnerabilities catalog, and was reported as under active exploitation after its 2017 disclosure, although the Apache Foundation disputed suggestions that this specific flaw was used in the Equifax breach. Do: Upgrade Apache Struts to 2.3.34, 2.5.13, or later, or apply the fixed updates for any Cisco or NetApp product that embeds Struts per their advisories. If patching is not immediate, remove or disable the REST plugin, or restrict the XML content types it accepts. Inventory internet-facing applications for Struts REST endpoints and hunt for suspicious XML POSTs, since the CVE is on the CISA KEV list and was reported as actively exploited. | 8.1 | 99% | KEV PoC |
| mass~100,000-300,000+ internet-exposed Struts servers and applications (only a subset exposing the vulnerable REST plugin); embedded Cisco/NetApp deployments… |
Full article538 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 15, 2017
It’s official, the Equifax data breach case was caused by the exploitation of the CVE-2017-5638 Apache Struts vulnerability.
The Equifax data breach case was solved, that incident was caused by the exploitation of the CVE-2017-5638 Apache Struts vulnerability. The vulnerability affects the Jakarta Multipart parser upload function in Apache and could be exploited by an attacker to make a maliciously crafted request to an Apache web server. Just after the experts from the Cisco Talos publicly disclosed it, proof-of-concept exploit code for Metasploit was made available allowing anyone to launch public scans. The attacks leveraging the flaw spiked and in one case crooks leveraged on the flaw to deliver Cerber ransomware of the vulnerable servers.
The vulnerability was fixed back in March, but the company did not update its systems, the thesis was also reported by an Apache spokeswoman to the Reuters agency.
The website of Equifax was updated only Wednesday while the company and law enforcement were investigating the incident.
“Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted. We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement.” reads the statement published by the company on its website.
Shortly after the Equifax data breach, security experts pointed out different possible causes for the incident, including the possible exploitation of the recently fixed CVE-2017-9805 Apache Struts vulnerability or a still unknown zero-day flaw.
Last week, security researchers with the firm Baird published a report that supported the thesis of the exploitation of a Struts vulnerability for the hack but did not specify which one was used by hackers.
Jeff Williams, CTO of Contrast Security, on Saturday, suggested the CVE-2017-5638 was likely the root cause of the Equifax dart breach.
“The first vulnerability from March seems much more likely because it’s easier to exploit and much better known. It also fits the timeline better, since it was released months before Equifax was attacked in July,” Williams wrote, “The process of rewriting, retesting, and redeploying can take months. I just visited one of the largest telecom providers where this effort took more than four months and millions of dollars. Without runtime protection in place, they have to do this every time a new library vulnerability comes out,” Williams.
Last week, the U.S. Sen. Mark Warner (D-VA) asked the Federal Trade Commission to investigate the security breach and verify cybersecurity safeguards adopted by the company.
“The volume and sensitivity of the data potentially involved in this breach raises serious questions about whether firms like Equifax adequately protect the enormous amounts of sensitive data they gather and commercialize,” Warner wrote, “In ways similar to the financial service industry’s systemic risk designation, I fear that firms like Equifax may illustrate a set of institutions whose activities, left unchecked, can significantly threaten the economic security of Americans.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Struts CVE-2017-5638 RCE, Equifax)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/63043/hacking/equifax-data-breach.html