Exploit / PoCcritical
Critical Apache Struts flaw CVE-2018
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2018-11776 | Apache Struts Remote Code Execution via Missing or Wildcard Namespace | 8.1 | 100% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 167.114.171.27 | from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27,” The exploit used in the attacks fetch a copy of CNRig Min |
| ipv4 | 95.161.225.94 | canning originated from the Russian and French IP addresses 95.161.225.94 and 167.114.171.27,” The exploit used in the attacks fetch |
From the original article
3 min read at securityaffairs.com
According to the threat intelligence firm Volexity, the CVE-2018-11776 vulnerability is already being abused in malicious attacks in the wild. Just yesterday I wrote about the availability online of the exploit code for the recently discovered Critical remote code execution vulnerability CVE-2018-11776 in Apache Struts 2. The PoC code was published on GitHub and experts were warning of the risks of massive attacks.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.