Critical Apache Struts flaw CVE-2018
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) | |
| CVE-2018-11776 | Apache Struts Remote Code Execution via Missing or Wildcard Namespace Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority. Do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values. | 8.1 | 100% | KEV PoC ×5 |
| massmillions of end users behind on the order of tens of thousands of internet-exposed Apache Struts deployments |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 167.114.171.27 | from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27,” The exploit used in the attacks fetch a copy of CNRig Min |
| ipv4 | 95.161.225.94 | canning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27,” The exploit used in the attacks fetch |
Full article704 words · extracted from securityaffairs.com · click to collapse
According to the threat intelligence firm Volexity, the CVE-2018-11776 vulnerability is already being abused in malicious attacks in the wild.
Just yesterday I wrote about the availability online of the exploit code for the recently discovered Critical remote code execution vulnerability CVE-2018-11776 in Apache Struts 2.
The PoC code was published on GitHub and experts were warning of the risks of massive attacks.
The CVE-2018-11776 vulnerability affects Struts versions from 2.3 through 2.3.34, Struts 2.5 through 2.5.16, and possibly unsupported versions of the framework.
The versions Struts 2.3.35 and 2.5.17 includes the security updates to address the CVE-2018-11776.
Struts developers also published a temporary workaround, but are recommending users to don’t use it and install the updates.
News of the day is that according to the threat intelligence firm Volexity, the flaw is already being abused in malicious attacks.
The vulnerability is trivial to exploit, it is possible to trigger the RCE flaw when namespace value isn’t set for a result defined in underlying xml configurations and at the same time, its upper action(s) configurations have no or wildcard namespace.
According to the experts from the threat intelligence firm Recorded Future, there is an intense activity related to the Struts flaw in a number of Chinese and Russian underground forums.
” Unfortunately, this makes the vulnerability trivial to exploit — in fact, proof-of-concept code has already been released, including a Python script that allows for easy exploitation. Recorded Future has also detected chatter in a number of Chinese and Russian underground forums around the exploitation of this vulnerability.” reads the analysis published by Recorded Future.
“Unlike last year’s Apache Struts exploit (CVE-2017-5638), which was at the center of the Equifax breach, this vulnerability appears easier to exploit because it does not require the Apache Struts installation to have any additional plugins running in order to successfully exploit it.”
Experts warn that the CVE-2018-11776 flaw is easier to exploit compared to the CVE-2017-5638Apache Struts flaw that was exploited in the Equifax hack.
The number of potentially vulnerable application could be impressive.
Researchers from Volexity announced to have observed the first malicious campaign targeting the vulnerability just after the PoC was published online.
Threat actors are leveraging the flaw in the attempt to install the CNRig cryptocurrency miner.
“Volexity has observed at least one threat actor attempting to exploit CVE-2018-11776 en masse in order to install the CNRig cryptocurrency miner.” states the report published by Volexity.
“The initial observed scanning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27,”
The exploit used in the attacks fetch a copy of CNRig Miner from Github (saves it as xrig) and a shell script from BitBucket by performing wget requests to the URLs the two pieces of code reside at.
The shell script removes previous instances of the miner, removes specific processes, and downloads three ELF crypto mining binaries.
Below the actions performed by the script:
- Remove any processes containing the keyword rabbit.
- Look for processes containing the keyword check in the name, removing it if it is not the current process.
- Remove any instances of upcheck.sh or xrig.
- Download three ELF cryptomining binaries, chmod them, execute the files, and then remove them.
- Remove nohup.out.
- Sleep for ten minutes (600 seconds).
The miners observed in this campaign target multiple architectures, including Intel, ARM, and MIPS.
“The three ELF binaries downloaded are executables for the Intel, ARM, and MIPS architectures. This is worth noting, as it shows the miner is capable of running across a wide range of hardware, such as servers, desktops, laptops, IOT devices, wireless routers, and more — nearly any internet connected device running a vulnerable instance of Apache Struts.”continues the report from Volexity.
The BitBucket folder involved in the attack contains both the shell script and the ELF binaries. Researchers observed that the mining account name is the same as the BitBucket account name.
I have no doubt, the number of campaigns targeting the CVE-2018-11776 vulnerability will rapidly increase. There is a large number of Apache Struts 2 installs still unpatched that are exposed online.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – CVE-2018-11776, Apache Struts 2)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/75724/hacking/cve-2018-11776-attacks.html