Attacks Under Way Against Easily Exploitable Apache Struts Flaw

Enterprises urged to upgrade now to more secure versions of Web application framework.

Security experts today urged enterprises using Apache Struts2 for Web applications to upgrade to either versions 2.3.32 or 2.5.10.1 as soon as possible after researchers from Cisco Talos disclosed an easily exploitable bug in all other versions of the open-source framework.
Exploits for the flaw are already available in the wild and attackers are using them to actively look for and target vulnerable Web servers. Most of the attacks appear to be taking advantage of a proof-of-concept exploit that was released publicly, Talos said in an
advisory.
The remotely executable flaw exists in something called the Jakarta Multipart parser in Struts. It allows attackers to inject malicious commands into certain HTTP requests, which are then executed by the Web server. What makes the vulnerability especially dangerous is that it allows attackers unauthenticated remote access to insert malicious commands and payloads of their choice into HTTP requests.
Researchers from Talos as well as other security vendors have observed numerous attempts by attackers to probe Web servers for the vulnerability using simple, seemingly harmless commands. In many cases, attackers are seeking to use the flaw to distribute malware, including DoS bots and IRC bouncers, according to Cisco Talos.
Many enterprises use Apache Struts because it enables much easier development of Java applications, says Johannes Ullrich, head of the Internet Storm Center at the SANS Institute. Not all Struts versions are automatically vulnerable, but many of them are even if they do not use the specific feature that triggers the vulnerability, he says.
An attacker will be able to execute arbitrary commands on the Web server, Ullrich says. The attacker is only limited by the permissions of the Web server.
Attackers typically will be able to read code and configuration files accessible to the Web server and thus likely will be able to connect to a database used by the Web application, Ullrich cautions.

More on Security
Live at Interop ITX
A typical compromise would first use the Struts vulnerability to install a back door. This will give the attacker a command prompt as the user running the web server, he notes. The attacker can then execute arbitrary commands, or use a privilege escalation exploit to obtain root or admin privileges.
Tom Sellers, threat analyst and security researcher at Rapid7, says the Jakarta Multipart parser where the flaw exists is basically a tool for processing Web requests that have multiple parts—which would be the case when uploading multiple files or different data types.
An attacker that leverages the vulnerability could execute operating system commands on the target and create, modify, and delete files, as well as modify system configuration, and run any system command for which the Web server software has access, Sellers says.
Rapid7 has observed attackers using multiple simple commands to determine if a particular Web server is vulnerable. One of them is the
ifconfig
command that returns the target’s network configuration information, and another is the
whoami
command that provides the name of the user account used by the Web server. This may allow the attacker to determine the level of system access that the software has, Sellers says.
WAF It
One stopgap measure that organizations can use to mitigate their exposure until they update the software is to use a Web application firewall, adds Craig Young, principal security researcher at Tripwire.
A WAF would work by monitoring incoming requests before they are processed and looking for unexpected values in the affected HTTP header, Young says. Alternatively, Apache has advised that Struts2 applications can be reconfigured to filter the content within Struts before it is processed.
Organizations must be prepared for the possibility that vulnerabilities can go from [being] unknown to being widely exploited very quickly, leaving little to no time for patches to be deployed, he says. This is why it is crucial for organizations to have security controls in place to recognize if a system has been compromised as well as to recognize when there is unpatched software in their environment.
Related stories:
Growing Open Source Use Heightens Enterprise Security Risks
Open Source, Third-Party Software Flaws Still Dog Developers
8 Valuable Security Certifications For 2017
When Hackers Hack Hackers

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Attacks Under Way Against Easily Exploitable Apache Struts Flaw