Slashdot Mirror
Apache Servers Under Attack Through Easily Exploitable Struts 2 Flaw (helpnetsecurity.com)
Orome1 quotes a report from Help Net Security: A critical vulnerability in Apache Struts 2 is being actively and heavily exploited, even though the patch for it has been released on Monday. The vulnerability (CVE-2017-5638) affects the Jakarta file upload Multipart parser in Apache Struts 2. It allows attackers to include code in the "Content-Type" header of an HTTP request, so that it is executed by the web server. Almost concurrently with the release of the security update that plugs the hole, a Metasploit module for targeting it has been made available. Unfortunately, the vulnerability can be easily exploited as it requires no authentication, and two very reliable exploits have already been published online. Also, vulnerable servers are easy to discover through simple web scanning. "Struts 2 is a Java framework that is commonly used by Java-based web applications," reports SANS ISC in their blog. "It is also known as 'Jakarta Struts' and 'Apache Struts.' The Apache project currently maintains Struts." Cisco Talos also has a blog detailing the attack.
Whoever chose struts 2 back then probably deserve it
Whoever chose struts 2 back then probably deserve it
Maybe not for the 6 months in which it was relevant, but for the 13[1] years where all java sweatshops kept on using that piece of shit yes, they deserve it.
[1]not a precise number
when did apache become something else than a webserver?
In 1999 the Apache Foundation got Tomcat, given to them by Sun. That may have been Apache's first project other than httpd.
What annoys me is that people I work with call all of the 50 or so different projects "Apache", without further specification. I'm well-versed in the Apache httpd code, I've contributed patches and I know configuration tricks and such. So when someone says "I'm having trouble with Apache" I go over to help, only to discover they're working on some Java thing.
The last link in the summary (Cisco Talos) includes a Windows payload.
Seriously, the last thing I think of when someone says Apache Servers is Struts, Tomcat, Java or anything else but Apache HTTPD.
Saying that "Apache Servers" are under "attack" and being exploited through a "Struts 2" flow is misleading to most of the world who does not know or care about Struts and just runs plain-jane websites.
Had they used a good, strongly typed language like Java, instead of crappy C, this wouldn't have happened!
Oh, wait...
This is not Apache Server issue. It is Struts 2 (that is under Apache umbrella) .
What would you recommend instead?
I acknowledge that it's not for everyone, but I'm really enjoying Vaadin right now.
Open Source Network Inventory for the masses! Kuwaiba
I looked at struts2 back in my enterprise java days. There was way too much automagic driven by rails envy where it was doing very dynamic things magically based on the request. Lots of stuff where the request would become a very complex java object that would interact with automagic libraries to do dangerous things and you just had to trust their weren't any exploits. I decided to use json servlets and single page web app frameworks instead.
Whoever chose struts 2 back then probably deserve it
Maybe not for the 6 months in which it was relevant, but for the 13[1] years where all java sweatshops kept on using that piece of shit yes, they deserve it.
[1]not a precise number
Struts 2 is fine. It works fine. It with JSP/JSTL is all you ever need in the general case. Everything else is sugar (except few problem domains where you truly need something new.) I like Vaadim and Stripes, but I've seen enough sites VERY WELL built with plain old Struts and JPS/JSTL to know it is the wielder, not the tool.)
If you have a decently built system that runs well on Struts, why change it? Just to try something new? That's not engineering, that's playing on someone else's dime.
Every damned software worth a damn has experienced a critical security bug. This is no different. And a solution is already available (patch it.)
Moreover, the exploit is only significant if you are not running your containers and httpd servers with least privileges (as nobody and/or chroot jailed/dockerized, with a user that has no login access, etc.)
Do that and your chances of getting 0-exploited drop dramatically regardless of what software you use.
As long as it is clearly documented what it will do, and you know what precisely what it will having it automatically do things isnt necessarily bad, can save time, as long as finer grain control is allowed. If it is poorly documented and does unexpected things, this is pretty bad. Allowing a system command to be run is a pretty nasty undocumented automatic behaviour.
What do you recommend? C/C++ programs facing the internet? I dont think there exists many large C/C++ programs that have not had severe buffer overflows. PHP/Perl/Ruby etc with their automatic memory management are relatively safe by comparison.
If you run Struts 2 on them then yes.
I used to talk like that about PHP. PHP has greatly improved over the years.
What are you talking about? Vaadin was published in 2002 and Struts 2 came out in 2005. Besides, I'm just saying that Vaadin is an option, that's all.
Open Source Network Inventory for the masses! Kuwaiba
This is a lesson in sanitizing inputs.
What happens is that the OGNL interpreter can get started with the HTTP headers as the input. Sepcifically the "Content-Type" header.
Why anyone thought that using a full on interpreter to parse a string attribute was a good idea is beyond me.
Ugh, this is misleading enough that the post should probably be corrected - how many Apache HTTPD users are having fits trying to figure out how to fix this "vulnerability" ??
Yes, it's now slightly less stinky than something that resembles moldy coffee grounds left in the coffee maker over the holidays, or Balmer's ass hole.
It seems all programming languages suck. C, after decades of careful revision, is well suited to certain tasks, but not the tasks that most of us do most of the time.