Story image

Apache Struts users warned to upgrade now as 'matter of urgency'

08 Sep 17

Attackers could take advantage of what is being called a ‘severe’ vulnerability in Apache Struts, an open source framework for developing applications in Java.

The vulnerability, CVE-2017-9805, affects all versions of Struts since 2008 and all applications using the framework’s REST plugin are vulnerable.

According to researchers at lgtm, patched versions of Struts were released on September 5, in versions 2.3.34 and 2.5.13.

Researchers have spotted several working exploits in various internet websites and users are being advised to upgrade their Apache Struts components ‘as a matter of urgency’.

The CVE-2017-9805 vulnerability allows remote attackers to “Execute arbitrary code on any server running an application built using the Struts framework and the popular REST communication plugin. The weakness is caused by the way Struts deserializes untrusted data,” according to an lgtm blog.

Although the lgtm have found a way to exploit the vulnerability, the team is not disclosing their findings.

According to official Apache Struts security bulletin, the 2.3.34 and 2.5.13 updates to the platform addresses security issues ranging from Denial of Service attacks and remote code executions.

“Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed to streamline the full development cycle, from building, to deploying, to maintaining applications over time,” the company says in its bulletin.

According to lgtm, a number of high profile global companies will be affected by the vulnerability.

Lgtm researcher Man Yue Mo discovered the vulnerability after discovering the unsafe deserialization method, of which there have been many similar vulnerabilities in the past.

He says the vunerability is a ‘huge risk’ because it is designed mainly for publicly-accessible web applications. It is currently used for several airline booking systems and financial institutions that use it for internet banking.

“On top of that, it is incredibly easy for an attacker to exploit this weakness: all you need is a web browser.”

 “When I ran the customized query on Struts there was exactly one result (Running it now will yield no result as the fix has been applied). I verified that it was a genuine remote code execution vulnerability before reporting it to the Struts security team. They have been very quick and responsive in working out a solution even though it is a fairly non-trivial task that requires API changes,” Man Yue Mo explains in the blog.

Organizations who use Struts should upgrade their components immediately,” Man Yue Mo concludes.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”