Apache servers under attack through easily exploitable Struts 2 flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.5.10.1 | ministrators are encouraged to upgrade to version 2.3.32 or 2.5.10.1 as soon as possible to avoid compromise. What is Apache Str |
Full article304 words · extracted from helpnetsecurity.com · click to collapse
A critical vulnerability in Apache Struts 2 is being actively and heavily exploited, even though the patch for it has been released on Monday.
System administrators are encouraged to upgrade to version 2.3.32 or 2.5.10.1 as soon as possible to avoid compromise.
What is Apache Struts 2, and how is the vulnerability exploited?
Apache Struts 2 is an open source web application framework for developing Java EE web applications.
The vulnerability (CVE-2017-5638), discovered and reported by Chinese developer Nike Zheng, affects the Jakarta file upload Multipart parser in Apache Struts 2. It allows attackers to include code in the “Content-Type” header of an HTTP request, so that it is executed by the web server.
Almost concurrently with the release of the security update that plugs the hole, a Metasploit module for targeting it has been made available.
Unfortunately, the vulnerability can be easily exploited as it requires no authentication, and two very reliable exploits have already been published online. Also, vulnerable servers are easy to discover through simple web scanning.
The attacks
SANS ISC and Cisco Talos say that they have witnessed many exploitation attempts and events since Monday.
“The majority of the exploitation attempts seem to be leveraging a publicly released PoC that is being used to run various commands. Talos has observed simple commands (i.e. whoami) as well as more sophisticated commands including pulling down a malicious ELF executable and execution,” the team shared. “The payloads have varied but include an IRC bouncer, a DoS bot, and a sample related to the bill gates botnet.”
Cisco has released Snort rules to block exploitation attempts. Given that these involve quite long “Content-Type” headers, SANS ISC CTO Johannes Ullrich says that it should be easy to catch them with Snort by lowering the “max_header_length” parameter in the http_inspect preprocessor to 500.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/03/09/apache-struts-2-attack/