11 Sep 2017
Emerging Threat – Apache Struts RCE Vulnerability
Are you running Apache Struts in your environment? Apache Struts vulnerability being exploited by attackers.
Researchers have discovered a vulnerability in the Apache Struts. A successful exploitation of the vulnerability will allow attackers to execute arbitrary code.
Apache Struts is an open-source framework for developing web applications using the Java programming language. It is used by many companies worldwide for their web properties.
Struts can be used for building internet-facing services such as online shops or discussion forums: with Struts, we can generate web pages on the fly, tailor web content for the current user as they move around on the site, respond to web forms filled in by visitors, and much more.
CVE-2017-9805 is a vulnerability in Apache Struts related to using the Struts REST plugin A successful exploitation of the vulnerability would allow a remote unauthenticated attacker to run malicious code on the application server to either take over the machine or launch further attacks from it.
A patch was released on September 5th, 2017 to address this vulnerability. Please refer to Apache announcement. Users are encouraged to update their installation of Apache Struts to version 2.3.34 or version 2.5.13 as soon as possible to remediate this threat. If an immediate upgrade is not possible, a change in the configuration to only serve HTML and JSON will mitigate the risk.
For more information on the topic and our Cyber Security Solutions & Services, please contact us by mail security@birger.technology.
BIRGER.
You may also like
15 May 2017
Security Threat - WannaCry Ransomware Attack
A new Cyber Security threat known as ''WannaCry'' has made the news all around the world this weekend. First reported on Friday 12 May 2017, it is a new RansomWare that is affecting most computers running the Windows Operating System and has unfortunately been very successful.
