Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Proof-of-Concept Released for Apache Struts Vulnerability

Python script for easier exploitation of the flaw is now available as well on Github.

That didn't take long: Last week, the Apache Foundation reported that a new serious vulnerability had been found in Struts. This week, proof-of-concept code for the flaw, including a Python script for easier code deployment, was found available on Github.

Unlike vulnerabilities that led to breaches like that at Equifax, this Struts vulnerability is the result of a specific configuration rather than a set of add-ins. While no exploit code had been found "in the wild" at the time of the original notice, the proof-of-concept code placed on Github is likely to shorten the interval until real exploitation is attempted by an attacker.

Meanwhile, Python code that probes for the vulnerabilities has been published to Github as well. A cursory examination of the Python script shows it is simple to check for the vulnerable configuration; the actual work is done in less than 20 lines of code.

Allan Liska, senior security architect at Recorded Future, says that exploiting the vulnerability now means that "a simple, well-crafted URL is enough to give an attacker access to a victim's Apache Struts installation. There is already exploit code on Github, and underground forums are talking about how to exploit it."

He warns that many large organizations may be unaware they are at risk, "because Struts underpins a number of different systems, including Oracle and Palo Alto."

All Apache Struts users have been urged to update to versions 2.3.35 or 2.5.17 as rapidly as possible to avoid exposure to a remote code execution attack exploiting the vulnerability.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:54:12 AM
Re: List of vulnerable applications?
want to make sure the patches are applied since the vulnerability is being exploited now. Not all the systems are ready most liley, we need to check the patches.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:52:49 AM
Re: List of vulnerable applications?
A cursory Google did not find a comprehensive list, and my patch management is pretty good Sounds like if we are up to date with recent version we are good to go.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:51:50 AM
Re: List of vulnerable applications?
Is there a list of systems that use Struts and are vulnerable in this way? I am sure lots of cloud providers use it. Better to double check the systems we use.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:49:53 AM
Re: List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Good to hear. It is always good to double check everything.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:48:45 AM
Apache Struts
Obviously we see more vulnerablities in Apache recently than before. We need these problems b resolved soon since lots of cloud providers use it.
wfishburne
50%
50%
wfishburne,
User Rank: Strategist
8/27/2018 | 3:50:51 PM
List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Is there a list of systems that use Struts and are vulnerable in this way? A cursory Google did not find a comprehensive list, and my patch management is pretty good, but I want to make sure the patches are applied since the vulnerability is being exploited now.
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1874
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the web-ba...
CVE-2019-1875
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by t...
CVE-2019-1876
PUBLISHED: 2019-06-20
A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exp...
CVE-2019-1878
PUBLISHED: 2019-06-20
A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insuff...
CVE-2019-1879
PUBLISHED: 2019-06-20
A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploi...