Apache Foundation rejects allegation Equifax hackers exploited CVE-2017
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) | |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin CVE-2017-9805 is an unsafe deserialization vulnerability in the REST plugin of Apache Struts 2, which uses the XStream library to deserialize XML request payloads without any type filtering. An attacker triggers it by sending a crafted XML payload to an endpoint handled by the REST plugin, causing the payload to be deserialized into arbitrary objects. Successful exploitation yields remote code execution on the server with the privileges of the web application, typically enough to fully take over the host. Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 are affected, including products from Cisco and NetApp that bundle vulnerable Struts versions. The flaw has a public proof-of-concept exploit, is on CISA's Known Exploited Vulnerabilities catalog, and was reported as under active exploitation after its 2017 disclosure, although the Apache Foundation disputed suggestions that this specific flaw was used in the Equifax breach. Do: Upgrade Apache Struts to 2.3.34, 2.5.13, or later, or apply the fixed updates for any Cisco or NetApp product that embeds Struts per their advisories. If patching is not immediate, remove or disable the REST plugin, or restrict the XML content types it accepts. Inventory internet-facing applications for Struts REST endpoints and hunt for suspicious XML POSTs, since the CVE is on the CISA KEV list and was reported as actively exploited. | 8.1 | 99% | KEV PoC |
| mass~100,000-300,000+ internet-exposed Struts servers and applications (only a subset exposing the vulnerable REST plugin); embedded Cisco/NetApp deployments… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | lgtm.com | . The flaw was discovered by security researchers at LGTM (lgtm.com), it could be exploited by a remote attacker to run malicio |
| sha1 | 5ea83fee5ee8c23ad95608b7e2022db5b48340ef | URL: https://github.com/rapid7/metasploit-framework/commit/5ea83fee5ee8c23ad95608b7e2022db5b48340ef Currently the vulnerability is being exploited in the wild, |
Full article1,044 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 11, 2017
Media and experts speculate Equifax Hack was the result of the exploitation of the recently discovered critical vulnerability CVE-2017-9805 in Apache Struts.
Last week Equifax reported a huge data breach, hackers accessed its systems between mid-May and late July. The incident affected roughly 143 million U.S. consumers and some customers in the U.K. and Canada.
The hackers accessed customers’ personal information, including names, social security numbers, dates of birth, addresses and, for some consumers also the driver’s license numbers. Equifax reported that hackers also accessed credit card numbers of roughly 209,000 consumers in the United States and dispute documents belonging to 182,000 people.
The company did not provide details of the attack, it only revealed that attackers exploited a web application vulnerability to access the information.
“criminals exploited a U.S. website application vulnerability to gain access to certain files.” Stated Equifax.
More details on the attack were shared by the financial services firm Baird that claimed the hackers exploited a vulnerability in the Apache Struts framework used by Equifax for its web applications.
“Our understanding is that data entered (and retained) through consumer portals/interactions (consumers inquiring about their credit reports, disputes, etc.) and data around it was breached via the Apache Struts flaw,” states a report published by Baird.
Immediately security experts concluded that hackers have exploited the recently discovered critical vulnerability CVE-2017-9805 in Apache Struts.
The flaw was discovered by security researchers at LGTM (lgtm.com), it could be exploited by a remote attacker to run malicious code on the vulnerable servers.
The remote code execution vulnerability exists when the REST plugin is used with the XStream handler for XML payloads.
“Security researchers at lgtm.com have discovered a critical remote code execution vulnerability in Apache Struts — a popular open-source framework for developing web applications in the Java programming language.” states the security advisory published by lgtm.com.”All versions of Struts since 2008 are affected; all web applications using the framework’s popular REST plugin are vulnerable. Users are advised to upgrade their Apache Struts components as a matter of urgency. This vulnerability has been addressed in Struts version 2.5.13.”
The vulnerability tracked as CVE-2017-9805 is related to the way Struts deserializes untrusted data, it affects all versions of Apache Struts since 2008, from Struts 2.5 to Struts 2.5.12.
The vulnerability was reported to Apache Struts development team in mid-July, but it was addressed only on September 5 with the release of Struts version 2.5.13.
According to the expert that has discovered the vulnerability, the flaw is easy to exploit, an attacker can trigger it by submitting a malicious XML code in a format.
“The Struts framework is used by an incredibly large number and variety of organizations. This vulnerability poses a huge risk, because the framework is typically used for designing publicly-accessible web applications. Struts is used in several airline booking systems as well as a number of financial institutions who use it in internet banking applications. On top of that, it is incredibly easy for an attacker to exploit this weakness: all you need is a web browser. Organizations who use Struts should upgrade their components immediately.” said Man Yue Mo, the LGTM security researcher that discovered the vulnerability.
The lgtm security team has developed an exploit code for this vulnerability, but it hasn’t disclosed it.
However, on September 6, it was reported the availability of a #Metaslpoit module to exploit the CVE 2017-9805, the module is available at the following URL:
https://github.com/rapid7/metasploit-framework/commit/5ea83fee5ee8c23ad95608b7e2022db5b48340ef
Currently the vulnerability is being exploited in the wild, anyway there is no evidence of exploitation before the patch was released.
Over the weekend the Apache Struts Project Management Committee (PMC) released an official statement to highlight that it is still unclear if the Equifax breach is linked to any Struts vulnerability, in particular the CVE-2017-9805.
“We are sorry to hear news that Equifax suffered from a security breach and information disclosure incident that was potentially carried out by exploiting a vulnerability in the Apache Struts Web Framework. At this point in time it is not clear which Struts vulnerability would have been utilized, if any.” Wrote the veeo for Struts René Gielen, in a post,
Gielen, who analyzed the vulnerability timeline, explained that while Equifax was breached in mid-May 2017, the Struts vulnerability CVE-2017-9805 was announced only in early September 2017.
Gielen therefore speculates that “the attackers either used an earlier announced vulnerability on an unpatched Equifax server or exploited a vulnerability not known at this point in time [July] – a so-called Zero-Day-Exploit.”
The outlet QZ.com alleged that the hackers exploited a flaw in Apache Struts, it also pointed out that the vulnerability may have been present in Struts for nine years.
Apache development ream rejected the accusation with the following statement:
“Regarding the assertion that especially CVE-2017-9805 is a nine year old security flaw, one has to understand that there is a huge difference between detecting a flaw after nine years and knowing about a flaw for several years. If the latter was the case, the team would have had a hard time to provide a good answer why they did not fix this earlier. But this was actually not the case here – we were notified just recently on how a certain piece of code can be misused, and we fixed this ASAP.”
It is more likely the hackers have targeted Equifax by exploiting the CVE-2017-5638 a vulnerability exploited in the wild since March.
“For either vulnerability, the process is basically the same. The attacker sends a specific HTTP request containing some special syntax,” explained Jeff Williams, co-founder and CTO at Contrast Security. “In one case, an OGNL expression. In the other, a serialized object. The Equifax Struts application would receive this request, and get tricked into executing operating system commands. The attacker can use these to take over the entire box – do anything the application can do. So, they probably stole the database credentials out of the application, ran some queries, and then exfiltrated the data to some server they control on the internet.”
New York Attorney General Eric T. Schneiderman announced the an official investigation into the Equifax security breach.
[adrotate banner=”9″]
(Security Affairs – Struts CVE-2017-9805 RCE, Equifax)
[adrotate banner=”12″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/62934/hacking/equifax-hack-struts.html