Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Proof-of-Concept Released for Apache Struts Vulnerability

Python script for easier exploitation of the flaw is now available as well on Github.

That didn't take long: Last week, the Apache Foundation reported that a new serious vulnerability had been found in Struts. This week, proof-of-concept code for the flaw, including a Python script for easier code deployment, was found available on Github.

Unlike vulnerabilities that led to breaches like that at Equifax, this Struts vulnerability is the result of a specific configuration rather than a set of add-ins. While no exploit code had been found "in the wild" at the time of the original notice, the proof-of-concept code placed on Github is likely to shorten the interval until real exploitation is attempted by an attacker.

Meanwhile, Python code that probes for the vulnerabilities has been published to Github as well. A cursory examination of the Python script shows it is simple to check for the vulnerable configuration; the actual work is done in less than 20 lines of code.

Allan Liska, senior security architect at Recorded Future, says that exploiting the vulnerability now means that "a simple, well-crafted URL is enough to give an attacker access to a victim's Apache Struts installation. There is already exploit code on Github, and underground forums are talking about how to exploit it."

He warns that many large organizations may be unaware they are at risk, "because Struts underpins a number of different systems, including Oracle and Palo Alto."

All Apache Struts users have been urged to update to versions 2.3.35 or 2.5.17 as rapidly as possible to avoid exposure to a remote code execution attack exploiting the vulnerability.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:54:12 AM
Re: List of vulnerable applications?
want to make sure the patches are applied since the vulnerability is being exploited now. Not all the systems are ready most liley, we need to check the patches.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:52:49 AM
Re: List of vulnerable applications?
A cursory Google did not find a comprehensive list, and my patch management is pretty good Sounds like if we are up to date with recent version we are good to go.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:51:50 AM
Re: List of vulnerable applications?
Is there a list of systems that use Struts and are vulnerable in this way? I am sure lots of cloud providers use it. Better to double check the systems we use.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:49:53 AM
Re: List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Good to hear. It is always good to double check everything.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2018 | 10:48:45 AM
Apache Struts
Obviously we see more vulnerablities in Apache recently than before. We need these problems b resolved soon since lots of cloud providers use it.
wfishburne
50%
50%
wfishburne,
User Rank: Strategist
8/27/2018 | 3:50:51 PM
List of vulnerable applications?
The comment about Palo Alto and Oracle being vulnerable to this exploit made me double check my systems for up-to-date patches. Is there a list of systems that use Struts and are vulnerable in this way? A cursory Google did not find a comprehensive list, and my patch management is pretty good, but I want to make sure the patches are applied since the vulnerability is being exploited now.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The security team seem to be taking SiegeWare seriously" 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5098
PUBLISHED: 2019-12-05
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. A specially crafted pixel shader can cause out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be trigger...
CVE-2012-1104
PUBLISHED: 2019-12-05
A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.
CVE-2019-17387
PUBLISHED: 2019-12-05
An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS.
CVE-2019-17388
PUBLISHED: 2019-12-05
Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications.
CVE-2019-18381
PUBLISHED: 2019-12-05
Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.