Critical security vulnerabilities in the widely used Apache Struts framework have enabled hackers to compromise corporate web servers and steal sensitive data. The vulnerabilities allow remote code execution, which hackers have used to install malware and access credentials, databases, and protected information. Companies are encouraged to immediately install available patches to mitigate risks from the Apache Struts vulnerabilities.

1. Apache Struts Vulnerabilities Compromise Corporate Web Servers
Summary
Critical security vulnerabilities in the Apache Struts software have enabled hackers to
compromise corporate Web servers, thereby putting sensitive corporate data at risk.
Technical Details
The vulnerabilities allow for remote code execution (RCE) by sending a special
request to a vulnerable server and dropping malware or other unauthorized code
after access is gained. It potentially enables actors to locate and identify credentials,
connect to the database server, and extract or delete the corporate data. Companies
and Non-Profit Organizations under attack may not immediately notice a
compromise.
Apache Struts is an open source and widely used no-cost framework for Java
application building. It is utilized across the financial services sector and other critical
infrastructure. As such, these vulnerabilities affect numerous industries, including
financial firms and third-party vendors on which financial firms rely. Vulnerabilities
associated with Apache Struts can exist on Web applications hosted on traditional
servers as well as be embedded in hardware devices such as multifunction printers
which support a Web interface for configuration and management.
Related vulnerabilities include:
• CVE-2017-5209: Allows remote attackers to manipulate Struts internals, alter
user sessions or affect container settings. Versions prior to Apache Struts
2.3.24.1 are vulnerable.
• CVE-2017-5638: Mishandles file upload, allowing remote attackers to execute
arbitrary commands. Versions prior to Apache Struts 2.3.32 and 2.5.10.1 are
vulnerable.
• CVE-2017-7672: Prepares a special URL which is used to overload server
process. The solution is to upgrade to Apache Struts version 2.5.12.
• CVE-2017-9787: Makes it possible to perform a denial of service attack. The
solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
• CVE-2017-9791: Allows remote code execution.
• CVE-2017-9793: Allows an unauthenticated, remote attacker to cause a denial
of service.
• CVE-2017-9804: Allows an unauthenticated, remote attacker to cause a denial
of service.
• CVE-2017-9805: Allows remote attackers to execute arbitrary code.
Prevention and Mitigation
Web application vulnerabilities or configuration weaknesses are regularly exploited.
Therefore, identification and closure of these vulnerabilities is crucial to avoiding
potential compromise. Patches to mitigate threats from Apache Struts vulnerabilities

2. have been released and are currently publicly available. It is recommended to
continue to monitor for new vulnerabilities and patches as they emerge. Also review
reliance on easily identified Internet connected devices for critical operations,
particularly those shared with public facing Web servers.
The following suggestions specify security and Web server specific practices:
• Employ regular updates to applications and the host operating system to
ensure protection against known vulnerabilities.
• Implement a least-privileges policy on the Web server to:
• Reduce adversaries’ ability to escalate privileges or pivot laterally to other
hosts.
• Control creation and execution of files in particular directories.
• If not already present, consider deploying a demilitarized zone (DMZ) between
your Web-facing systems and the corporate network. Limiting the interaction
and logging traffic between the two provides a method to identify possible
malicious activity.
• Ensure a secure configuration of Web servers throughout the compliance
management process blocking unnecessary services and ports and necessary
services and ports should be restricted where feasible and not using default
login credentials.
• Utilize a reverse proxy or alternative service, such as modsecurity, to restrict
accessible URL paths to known legitimate ones.
• Establish, and backup offline, a “known good” version of the relevant server
and a regular change-management policy to enable monitoring for changes to
servable content with a file integrity system.
• Employ user input validation to restrict local and remote file inclusion
vulnerabilities.
• Conduct regular system and application vulnerability scans to establish areas
of risk. While this method does not protect against zero day attacks it will
highlight possible areas of concern.
• Deploy a Web application firewall and conduct regular virus signature checks,
application fuzzing, code reviews and server network analysis.
Detection
The following may be indicators that your Web server has been infected by malware.
Note a number of these indicators are common to legitimate files. Any suspected
malicious files should be considered in the context of other indicators and triaged to
determine whether further inspection or validation is required.
• Abnormal periods of high site usage (due to potential uploading and
downloading activity);
• Files with an unusual timestamp (e.g., more recent than the last update of the
Web applications installed);
• Suspicious files in Internet accessible locations such as web root;
• Files containing references to suspicious keywords such as cmd.exe or eval;

3. • Unexpected connections in logs:
• A file type generating unexpected or anomalous network traffic (e.g., a JPG
file making requests with POST parameters);
• Suspicious logins originating from internal subnets to DMZ servers and vice
versa.
• Any evidence of suspicious shell commands, such as directory traversal, by
the Web server process.
During known incidents involving one of the above Apache Struts vulnerabilities, the
actors deployed the following webshells. (The below MD5 hash values are provided
for network defense by U.S. CERT):
• MD5 = 75a504a0679d909baf4ad56356a7a6ad
• MD5 = 026ab37483b9fe4525be794c9c37fdc8
• MD5 = af99906f8dc68e51236b20150b85d674
• MD5 = ab364a37dc45d7fa5a09ec0ddea1415f
• MD5 = f068a5d7087a5ebe3a33bb57d4ccf2b9
• MD5 = cc5678b14ce6961522ca1813906b0098
• MD5 = cefe091c4ad39ff06d5275c6201989d1
• MD5 = bde8793c0712c08c468de000cb24fa8c
• MD5 = ef3981b9cffd41265ff2c65ef010f358
• MD5 = 1a02e6179cfc8118c1864890ea0e5e77
Reporting
Compliance officials and patch managers are encouraged to add the necessary
updates to the patch que as soon as possible due to the continued and legacy use of
Apache Struts in corporate environments.