Equifax Suffered Data Breach After It Failed to Patch Old Apache Struts Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data. Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise. | 9.8 | 100% | KEV ransomware PoC ×10 |
| masslikely hundreds of thousands of deployments (tens of thousands of Struts hosts were internet-exposed in public scans) | |
| CVE-2017-9805 | XML Deserialization RCE in Apache Struts 2 REST Plugin CVE-2017-9805 is an unsafe deserialization vulnerability in the REST plugin of Apache Struts 2, which uses the XStream library to deserialize XML request payloads without any type filtering. An attacker triggers it by sending a crafted XML payload to an endpoint handled by the REST plugin, causing the payload to be deserialized into arbitrary objects. Successful exploitation yields remote code execution on the server with the privileges of the web application, typically enough to fully take over the host. Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 are affected, including products from Cisco and NetApp that bundle vulnerable Struts versions. The flaw has a public proof-of-concept exploit, is on CISA's Known Exploited Vulnerabilities catalog, and was reported as under active exploitation after its 2017 disclosure, although the Apache Foundation disputed suggestions that this specific flaw was used in the Equifax breach. Do: Upgrade Apache Struts to 2.3.34, 2.5.13, or later, or apply the fixed updates for any Cisco or NetApp product that embeds Struts per their advisories. If patching is not immediate, remove or disable the REST plugin, or restrict the XML content types it accepts. Inventory internet-facing applications for Struts REST endpoints and hunt for suspicious XML POSTs, since the CVE is on the CISA KEV list and was reported as actively exploited. | 8.1 | 99% | KEV PoC |
| mass~100,000-300,000+ internet-exposed Struts servers and applications (only a subset exposing the vulnerable REST plugin); embedded Cisco/NetApp deployments… |
Full article635 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 14, 2017
The massive Equifax data breach that exposed highly sensitive data of as many as 143 million people was caused by exploiting a flaw in Apache Struts framework, which Apache patched over two months earlier of the security incident, Equifax has confirmed.
Credit rating agency Equifax is yet another example of the companies that became victims of massive cyber attacks due to not patching a critical vulnerability on time, for which patches were already issued by the respected companies.
Rated critical with a maximum 10.0 score, the Apache Struts2 vulnerability (CVE-2017-5638) exploited in the Equifax breach was disclosed and fixed by Apache on March 6 with the release of Apache Struts version 2.3.32 or 2.5.10.1.
This flaw is separate from CVE-2017-9805, another Apache Struts2 vulnerability that was patched earlier this month, which was a programming bug that manifests due to the way Struts REST plugin handles XML payloads while deserializing them, and was fixed in Struts version 2.5.13.
Right after the disclosure of the vulnerability, hackers started actively exploiting the flaw in the wild to install rogue applications on affected web servers after its proof-of-concept (PoC) exploit code was uploaded to a Chinese site.
Despite patches were made available and proofs that the flaw was already under mass attack by hackers, Equifax failed to patched its Web applications against the flaw, which resulted in the breach of personal data of nearly half of the US population.
"Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cyber security firm to determine what information was accessed and who have been impacted," the company officials wrote in an update on the website with a new "A Progress Update for Consumers."
"We know that criminals exploited a US website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement."
CVE-2017-5638 was a then-zero-day vulnerability discovered in the popular Apache Struts web application framework by Cisco's Threat intelligence firm Talos, which observed a number of active attacks exploiting the flaw.
The issue was a remote code execution bug in the Jakarta Multipart parser of Apache Struts2 that could allow an attacker to execute malicious commands on the server when uploading files based on the parser.
At the time, Apache warned it was possible to perform a remote code execution attack with "a malicious Content-Type value," and if this value is not valid "an exception is thrown which is then used to display an error message to a user."
Also Read: Steps You Should Follow to Protect Yourself From Equifax Breach
For those unaware, Apache Struts is a free, open-source MVC framework for developing web applications in the Java programming language that run both front-end and back-end Web servers. The framework is used by 65n per cent of the Fortune 100 companies, including Lockheed Martin, Vodafone, Virgin Atlantic, and the IRS.
Since the hackers are actively exploiting the vulnerabilities in the Apache Struts web framework, Cisco has also initiated an investigation into its products against four newly discovered security vulnerabilities in Apache Struts2.
Other companies that also incorporate a version of Apache Struts 2 should also check their infrastructures against these vulnerabilities.
Equifax is currently offering free credit-monitoring and identity theft protection services for people who are affected by the massive data leak and has also enabled a security freeze for access to people's information.
While the company was initially criticised for generating a PIN that was simply a time and date stamp and easy-to-guess, the PIN generation method was later changed to randomly generate numbers.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2017/09/equifax-apache-struts.html