Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/9/2017
04:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attacks Under Way Against Easily Exploitable Apache Struts Flaw

Enterprises urged to upgrade now to more secure versions of Web application framework.

Security experts today urged enterprises using Apache Struts2 for Web applications to upgrade to either versions 2.3.32 or 2.5.10.1 as soon as possible after researchers from Cisco Talos disclosed an easily exploitable bug in all other versions of the open-source framework.

Exploits for the flaw are already available in the wild and attackers are using them to actively look for and target vulnerable Web servers. Most of the attacks appear to be taking advantage of a proof-of-concept exploit that was released publicly, Talos said in an advisory.

The remotely executable flaw exists in something called the Jakarta Multipart parser in Struts. It allows attackers to inject malicious commands into certain HTTP requests, which are then executed by the Web server. What makes the vulnerability especially dangerous is that it allows attackers unauthenticated remote access to insert malicious commands and payloads of their choice into HTTP requests.

Researchers from Talos as well as other security vendors have observed numerous attempts by attackers to probe Web servers for the vulnerability using simple, seemingly harmless commands. In many cases, attackers are seeking to use the flaw to distribute malware, including DoS bots and IRC bouncers, according to Cisco Talos.

Many enterprises use Apache Struts because it enables much easier development of Java applications, says Johannes Ullrich, head of the Internet Storm Center at the SANS Institute. Not all Struts versions are automatically vulnerable, but many of them are even if they do not use the specific feature that triggers the vulnerability, he says.

"An attacker will be able to execute arbitrary commands on the Web server," Ullrich says. "The attacker is only limited by the permissions of the Web server."

Attackers typically will be able to read code and configuration files accessible to the Web server and thus likely will be able to connect to a database used by the Web application, Ullrich cautions.

"A typical compromise would first use the Struts vulnerability to install a back door. This will give the attacker a command prompt as the user running the web server," he notes. The attacker can then execute arbitrary commands, or use a privilege escalation exploit to obtain root or admin privileges.

Tom Sellers, threat analyst and security researcher at Rapid7, says the Jakarta Multipart parser where the flaw exists is basically a tool for processing Web requests that have multiple parts—which would be the case when uploading multiple files or different data types.

An attacker that leverages the vulnerability could execute operating system commands on the target and create, modify, and delete files, as well as modify system configuration, and run any system command for which the Web server software has access, Sellers says.

Rapid7 has observed attackers using multiple simple commands to determine if a particular Web server is vulnerable. One of them is the ifconfig command that returns the target’s network configuration information, and another is the whoami command that provides the name of the user account used by the Web server. "This may allow the attacker to determine the level of system access that the software has," Sellers says.

WAF It

One stopgap measure that organizations can use to mitigate their exposure until they update the software is to use a Web application firewall, adds Craig Young, principal security researcher at Tripwire.

"A WAF would work by monitoring incoming requests before they are processed and looking for unexpected values in the affected HTTP header," Young says. "Alternatively, Apache has advised that Struts2 applications can be reconfigured to filter the content within Struts before it is processed."

"Organizations must be prepared for the possibility that vulnerabilities can go from [being] unknown to being widely exploited very quickly, leaving little to no time for patches to be deployed," he says. "This is why it is crucial for organizations to have security controls in place to recognize if a system has been compromised as well as to recognize when there is unpatched software in their environment."

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7843
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7846
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7847
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
CVE-2019-7848
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7850
PUBLISHED: 2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.