CyberScooppublished Aug 22, 19:22 UTC (Aug 22, 2018)ingested Sep 10, 05:54 UTC@HowellONeill

New critical vulnerability exposes Apache Struts instances to remote attacks

criticalVulnerability exploited in the wildimportance 60CVE-2018-11776

Read the original

Tagscve-2018-11776 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2018-11776	Apache Struts Remote Code Execution via Missing or Wildcard Namespace Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority. Do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values.	8.1	100%	KEV PoC ×5	Apache Struts 2 2.3.7-2.3.34 and 2.5-2.5.16 (fixed in 2.3.35 and 2.5.17, per vendor advisory)	massmillions of end users behind on the order of tens of thousands of internet-exposed Apache Struts deployments	Aug 22, 2018

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2018-11776

Apache Struts Remote Code Execution via Missing or Wildcard Namespace

Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority.

Do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values.

8.1

100%

KEV PoC ×5

Apache Struts 2 2.3.7-2.3.34 and 2.5-2.5.16 (fixed in 2.3.35 and 2.5.17, per vendor advisory)

massmillions of end users behind on the order of tens of thousands of internet-exposed Apache Struts deployments

Aug 22, 2018

Full article518 words · extracted from cyberscoop.com · click to collapse

Get our latest cybersecurity news first on Google.

Click here!

Update your Apache Struts instances now.

A critical remote code execution vulnerability in Apache Struts, a popular open source web application software framework, allows hackers to take over targeted machines in attacks.

The vulnerability (CVE-2018-11776) impacts the software, which is used by an estimated 65 percent of Fortune 100 companies and growing.

Tuesday’s vulnerability is credited to insufficient validation of untrusted user data in the core of Struts. The announcement provoked a worried response from information security experts:

The new Struts vulnerability was identified in April by Man Yue Mo from the Semmle Security Research Team. It was patched in June and publicly announced on Tuesday. Apache Struts users are urged to patch immediately.

“Critical remote code execution vulnerabilities like the one that affected Equifax and the one we announced today are incredibly dangerous for several reasons: Struts is used for publicly-accessible customer-facing websites, vulnerable systems are easily identified, and the flaw is easy to exploit,” said Pavel Avgustinov, a co-founder at Semmle.

“A hacker can find their way in within minutes, and exfiltrate data or stage further attacks from the compromised system. It’s crucially important to update affected systems immediately; to wait is to take an irresponsible risk.”

An Apache Struts vulnerability was famously a key reason for the 2017 Equifax breach leading to the theft of data of 148 million people and potentially cost upwards of $600 million, according to the company.

Soon after the public announcement of the vulnerability used against Equifax, hackers attempted to use the vulnerability more widely including against U.S. government targets like the Pentagon.

“The vulnerability that took down Equifax last year when it was released in March, we had a nation-state actor within 24 hours scanning looking for unpatched servers within the DoD,” David Hogue, a senior technical director for the NSA’s Cybersecurity Threat Operations Center (NCTOC), said earlier this year.

Latest Podcasts

Government

Technology

Threats

Policy

Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/apache-struts-vulnerability-rce-semmle/