Canadian agency breached as hackers exploit CVE-2017
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) |
Full article504 words · extracted from securityaffairs.com · click to collapse
Canada Revenue Agency confirmed it shut down its website for filing federal taxes due to a cyber attack leveraging the CVE-2017-5638 flaw in Apache Struts 2
The Canada Revenue Agency (CRA) confirmed it shut down its website for filing federal taxes after hackers broke into the server at the nation’s statistics bureau. The security breach occurred last week and attackers exploited the recently discovered CVE-2017-5638 flaw in Apache Struts 2.
The CVE-2017-5638 flaw is a remote code execution zero-day that has been exploiting by attackers in the wild, it affects Struts 2.3.5 through 2.3.31 and Struts 2.5 through 2.5.10.
The issue was first spotted by the Chinese developer Nike Zheng, the attack sends an invalid Content-Type value to the uploader throwing an exception creating the condition for the remote code execution.
The issue is documented at Rapid7’s Metasploit Framework GitHub site and attackers in the wild are exploiting a publicly available PoC code that triggers the vulnerability.
“Talos has observed a new Apache vulnerability that is being actively exploited in the wild. The vulnerability (CVE-2017-5638) is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, referenced in this security advisory.” reads the security advisory published by the Talos group. “Talos began investigating for exploitation attempts and found a high number of exploitation events.”
According to the experts from Cisco Talos, the flaw affects the Jakarta-based file upload Multipart parser under Apache Struts 2.
This week, Cisco confirmed that the vulnerability affects the Cisco Identity Services Engine (ISE), the Prime Service Catalog Virtual Appliance, and the Unified SIP Proxy Software.
The Canada Revenue Agency publicly confirmed in a press conference held in Ottawa yesterday that the CVE-2017-5638 affecting Apache Struts 2 was exploited by hackers to shut down its services over the weekend.
Federal government officials declared that no personal information was compromised due to the cyber attack on the Canada Revenue Agency’s online tax services.
“Due to our quick and proactive approach, we’re confident that we’ve prevented government information, including the personal information of Canadians, from being breached,” Jennifer Dawson, deputy chief information officer for the Treasury Board of Canada Secretariat said. “We’ve seen no evidence of this information being compromised.”
John Glowacki, chief operating officer of Shared Services Canada, confirmed that the CVE-2017-5638 flaw in Apache Struts 2 poses “specific and credible threat” to certain government IT systems worldwide.
“We will not speak for other countries, but we will say we have information that some other countries are having greater problems with this specific vulnerability,” Glowacki added.
The Canadian authorities informed that the Statistics Canada’s Website was taken down last Thursday in order to fix the issue.
IT vendors are investigating their products about the possible impact of the flaw in Apache Struts 2, after Cisco also VMware has issuing a security advisory warning of the impact on Horizon Desktop as-a-Service, vCenter Server, vRealize Operations Manager and vRealize Hyperic Server solutions.
[adrotate banner=”9″]
(Security Affairs – Apache Struts 2, Canada Revenue Agency)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/57130/hacking/cra-apache-struts-hack.html