Attacks/Breaches

3/9/2017
04:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attacks Under Way Against Easily Exploitable Apache Struts Flaw

Enterprises urged to upgrade now to more secure versions of Web application framework.

Security experts today urged enterprises using Apache Struts2 for Web applications to upgrade to either versions 2.3.32 or 2.5.10.1 as soon as possible after researchers from Cisco Talos disclosed an easily exploitable bug in all other versions of the open-source framework.

Exploits for the flaw are already available in the wild and attackers are using them to actively look for and target vulnerable Web servers. Most of the attacks appear to be taking advantage of a proof-of-concept exploit that was released publicly, Talos said in an advisory.

The remotely executable flaw exists in something called the Jakarta Multipart parser in Struts. It allows attackers to inject malicious commands into certain HTTP requests, which are then executed by the Web server. What makes the vulnerability especially dangerous is that it allows attackers unauthenticated remote access to insert malicious commands and payloads of their choice into HTTP requests.

Researchers from Talos as well as other security vendors have observed numerous attempts by attackers to probe Web servers for the vulnerability using simple, seemingly harmless commands. In many cases, attackers are seeking to use the flaw to distribute malware, including DoS bots and IRC bouncers, according to Cisco Talos.

Many enterprises use Apache Struts because it enables much easier development of Java applications, says Johannes Ullrich, head of the Internet Storm Center at the SANS Institute. Not all Struts versions are automatically vulnerable, but many of them are even if they do not use the specific feature that triggers the vulnerability, he says.

"An attacker will be able to execute arbitrary commands on the Web server," Ullrich says. "The attacker is only limited by the permissions of the Web server."

Attackers typically will be able to read code and configuration files accessible to the Web server and thus likely will be able to connect to a database used by the Web application, Ullrich cautions.

"A typical compromise would first use the Struts vulnerability to install a back door. This will give the attacker a command prompt as the user running the web server," he notes. The attacker can then execute arbitrary commands, or use a privilege escalation exploit to obtain root or admin privileges.

Tom Sellers, threat analyst and security researcher at Rapid7, says the Jakarta Multipart parser where the flaw exists is basically a tool for processing Web requests that have multiple parts—which would be the case when uploading multiple files or different data types.

An attacker that leverages the vulnerability could execute operating system commands on the target and create, modify, and delete files, as well as modify system configuration, and run any system command for which the Web server software has access, Sellers says.

Rapid7 has observed attackers using multiple simple commands to determine if a particular Web server is vulnerable. One of them is the ifconfig command that returns the target’s network configuration information, and another is the whoami command that provides the name of the user account used by the Web server. "This may allow the attacker to determine the level of system access that the software has," Sellers says.

WAF It

One stopgap measure that organizations can use to mitigate their exposure until they update the software is to use a Web application firewall, adds Craig Young, principal security researcher at Tripwire.

"A WAF would work by monitoring incoming requests before they are processed and looking for unexpected values in the affected HTTP header," Young says. "Alternatively, Apache has advised that Struts2 applications can be reconfigured to filter the content within Struts before it is processed."

"Organizations must be prepared for the possibility that vulnerabilities can go from [being] unknown to being widely exploited very quickly, leaving little to no time for patches to be deployed," he says. "This is why it is crucial for organizations to have security controls in place to recognize if a system has been compromised as well as to recognize when there is unpatched software in their environment."

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: New camera 2FA closed loop!
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20050
PUBLISHED: 2018-12-10
Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method.
CVE-2018-20051
PUBLISHED: 2018-12-10
Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on.
CVE-2018-20029
PUBLISHED: 2018-12-10
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
CVE-2018-1279
PUBLISHED: 2018-12-10
Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on ...
CVE-2018-15800
PUBLISHED: 2018-12-10
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.