Attacks/Breaches
3/9/2017
04:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attacks Under Way Against Easily Exploitable Apache Struts Flaw

Enterprises urged to upgrade now to more secure versions of Web application framework.

Security experts today urged enterprises using Apache Struts2 for Web applications to upgrade to either versions 2.3.32 or 2.5.10.1 as soon as possible after researchers from Cisco Talos disclosed an easily exploitable bug in all other versions of the open-source framework.

Exploits for the flaw are already available in the wild and attackers are using them to actively look for and target vulnerable Web servers. Most of the attacks appear to be taking advantage of a proof-of-concept exploit that was released publicly, Talos said in an advisory.

The remotely executable flaw exists in something called the Jakarta Multipart parser in Struts. It allows attackers to inject malicious commands into certain HTTP requests, which are then executed by the Web server. What makes the vulnerability especially dangerous is that it allows attackers unauthenticated remote access to insert malicious commands and payloads of their choice into HTTP requests.

Researchers from Talos as well as other security vendors have observed numerous attempts by attackers to probe Web servers for the vulnerability using simple, seemingly harmless commands. In many cases, attackers are seeking to use the flaw to distribute malware, including DoS bots and IRC bouncers, according to Cisco Talos.

Many enterprises use Apache Struts because it enables much easier development of Java applications, says Johannes Ullrich, head of the Internet Storm Center at the SANS Institute. Not all Struts versions are automatically vulnerable, but many of them are even if they do not use the specific feature that triggers the vulnerability, he says.

"An attacker will be able to execute arbitrary commands on the Web server," Ullrich says. "The attacker is only limited by the permissions of the Web server."

Attackers typically will be able to read code and configuration files accessible to the Web server and thus likely will be able to connect to a database used by the Web application, Ullrich cautions.

"A typical compromise would first use the Struts vulnerability to install a back door. This will give the attacker a command prompt as the user running the web server," he notes. The attacker can then execute arbitrary commands, or use a privilege escalation exploit to obtain root or admin privileges.

Tom Sellers, threat analyst and security researcher at Rapid7, says the Jakarta Multipart parser where the flaw exists is basically a tool for processing Web requests that have multiple parts—which would be the case when uploading multiple files or different data types.

An attacker that leverages the vulnerability could execute operating system commands on the target and create, modify, and delete files, as well as modify system configuration, and run any system command for which the Web server software has access, Sellers says.

Rapid7 has observed attackers using multiple simple commands to determine if a particular Web server is vulnerable. One of them is the ifconfig command that returns the target’s network configuration information, and another is the whoami command that provides the name of the user account used by the Web server. "This may allow the attacker to determine the level of system access that the software has," Sellers says.

WAF It

One stopgap measure that organizations can use to mitigate their exposure until they update the software is to use a Web application firewall, adds Craig Young, principal security researcher at Tripwire.

"A WAF would work by monitoring incoming requests before they are processed and looking for unexpected values in the affected HTTP header," Young says. "Alternatively, Apache has advised that Struts2 applications can be reconfigured to filter the content within Struts before it is processed."

"Organizations must be prepared for the possibility that vulnerabilities can go from [being] unknown to being widely exploited very quickly, leaving little to no time for patches to be deployed," he says. "This is why it is crucial for organizations to have security controls in place to recognize if a system has been compromised as well as to recognize when there is unpatched software in their environment."

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.