Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Proof-of-Concept Released for Apache Struts Vulnerability

Python script for easier exploitation of the flaw is now available as well on Github.

That didn't take long: Last week, the Apache Foundation reported that a new serious vulnerability had been found in Struts. This week, proof-of-concept code for the flaw, including a Python script for easier code deployment, was found available on Github.

Unlike vulnerabilities that led to breaches like that at Equifax, this Struts vulnerability is the result of a specific configuration rather than a set of add-ins. While no exploit code had been found "in the wild" at the time of the original notice, the proof-of-concept code placed on Github is likely to shorten the interval until real exploitation is attempted by an attacker.

Meanwhile, Python code that probes for the vulnerabilities has been published to Github as well. A cursory examination of the Python script shows it is simple to check for the vulnerable configuration; the actual work is done in less than 20 lines of code.

Allan Liska, senior security architect at Recorded Future, says that exploiting the vulnerability now means that "a simple, well-crafted URL is enough to give an attacker access to a victim's Apache Struts installation. There is already exploit code on Github, and underground forums are talking about how to exploit it."

He warns that many large organizations may be unaware they are at risk, "because Struts underpins a number of different systems, including Oracle and Palo Alto."

All Apache Struts users have been urged to update to versions 2.3.35 or 2.5.17 as rapidly as possible to avoid exposure to a remote code execution attack exploiting the vulnerability.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:54:12 AM
Re: List of vulnerable applications?
want to make sure the patches are applied since the vulnerability is being exploited now. Not all the systems are ready most liley, we need to check the patches.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:52:49 AM
Re: List of vulnerable applications?
A cursory Google did not find a comprehensive list, and my patch management is pretty good Sounds like if we are up to date with recent version we are good to go.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:51:50 AM
Re: List of vulnerable applications?
Is there a list of systems that use Struts and are vulnerable in this way? I am sure lots of cloud providers use it. Better to double check the systems we use.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:49:53 AM
Re: List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Good to hear. It is always good to double check everything.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:48:45 AM
Apache Struts
Obviously we see more vulnerablities in Apache recently than before. We need these problems b resolved soon since lots of cloud providers use it.
wfishburne
50%
50%
wfishburne,
User Rank: Strategist
8/27/2018 | 3:50:51 PM
List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Is there a list of systems that use Struts and are vulnerable in this way? A cursory Google did not find a comprehensive list, and my patch management is pretty good, but I want to make sure the patches are applied since the vulnerability is being exploited now.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4019
PUBLISHED: 2020-06-01
The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app's cmd.exe via a untrusted search path vulnerability.
CVE-2020-4020
PUBLISHED: 2020-06-01
The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Server instance that the Companion App is connected to, execute arbitrary .exe files via a Protection Mechanism Failure.
CVE-2020-4021
PUBLISHED: 2020-06-01
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.
CVE-2020-4023
PUBLISHED: 2020-06-01
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
CVE-2020-4013
PUBLISHED: 2020-06-01
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.