Apache Struts vulnerability affects versions since 2008
A researcher discovered a remotely exploitable Apache Struts vulnerability being actively exploited in the wild. A patch was released, and users were urged to update software immediately.
A security researcher discovered an Apache Struts vulnerability that affects versions of the web application development framework going back to 2008.
Man Yue Mo, a researcher at the open source software project LGTM.com run by San Francisco-based software analytics firm Semmle Inc., disclosed the remotely executable Apache Struts vulnerability, which he said was "a result of unsafe deserialization in Java" and could lead to arbitrary code execution. Mo originally disclosed the issue to Apache on July 17, 2017.
Mo publicly disclosed the Apache Struts vulnerability on Sept. 5, and the Apache Struts group released patches the same day. But by the morning of Sept. 6, Mo updated his post because "multiple working exploits [were] observed on various places on the internet."
"I verified that it was a genuine remote code execution [RCE] vulnerability before reporting it to the Struts security team. They have been very quick and responsive in working out a solution even though it is a fairly non-trivial task that requires API changes," Mo wrote in a blog post. "Due to the severity of this finding I will not disclose more details at this stage. Rather, I will update this blog post in a couple of weeks' time with more information."
Mo's discovery is the latest in string of serious Apache Struts vulnerabilities that have been disclosed recently. In March, for example, an RCE vulnerability was patched after being actively exploited by attackers.
Boris Chen, vice president of engineering and co-founder of tCell Inc., a San Francisco-based web applications security company, said, "Serialization exploits resulting in RCE are one of the most serious yet underreported vulnerabilities that applications face today, and it doesn't seem to be waning. For Apache Struts alone, this is the fourth RCE vulnerability this year."
The newly discovered Apache Struts vulnerability is a stark reminder that while websites represent the front line for most organizations, they can also become the front door for attackers.
Brian Robisonsenior director of security technology, Cylance Inc.
Michael Patterson, CEO of Plixer International Inc., a network traffic analysis company based in Kennebunk, Maine, said this Apache Struts vulnerability "is a significant finding, given that the majority of our largest companies are using Apache Struts."
"Although a patch for the vulnerability has since been released, given that many companies don't stay on top of patches, there still could be plenty of time for malicious code writers to exploit it," Patterson told SearchSecurity. "Most organizations are aware that there is absolutely no way to prevent being compromised."
Brian Robison, senior director of security technology at Cylance Inc., based in Irvine, Calif., said attacks like this are not new, but should be a wake-up call.
"The newly discovered Apache Struts vulnerability is a stark reminder that while websites represent the front line for most organizations, they can also become the front door for attackers. Many organizations develop layers of security to protect their public-facing websites, but in some cases, those layers can't stop something that looks like normal behavior," Robinson told SearchSecurity.
"No matter whether someone is using Apache, IIS or any other web server, it is critical that they keep up with patches and security feeds. A web server that is left idle while the company focuses on building the content can quickly become ground zero for a widespread attack."
