Thursday, June 20, 2024

New Apache Struts Vulnerability Allows Attackers to Take Control Over Web Servers

Apache Struts is a free and open-source framework used to build Java web applications.This is not the first remote code execution vulnerability discovered on Apache Struts.

Security Expert from Man Yue Mo from lgtm found a remote code execution vulnerability in Apache Struts. This vulnerability has been assigned with Security Bulletin CVE-2017-9805

Experts found the vulnerability due to unsafe deserialization in Java.In the Last March also an RCE vulnerability reported by Nike Zheng with Struts 2.3.31 & 2.3.5.

Also Read :  ApacheStruts2 Remote Code Execution Vulnerability S2-046

What is Java Deserialization

Java deserialization weakness influences essentially all applications that acknowledge serialized Java objects and gives attackers an approach to increase a complete remote control of an application server.

The vulnerability enables aggressors to obtain total control over the server on which the application is facilitated and make a wide range of destruction.

The vulnerability enables aggressors to obtain total control over the server on which the application is facilitated and make a wide range of destruction.

As indicated by the researcher, the exploit is caused by the way Struts deserializes unsanitized client provided information.

An aggressor could transfer a malicious file and obtain control over an application subsequent to increasing remote code execution rights on the objective’s Struts-based application server.

An aggressor could transfer a malicious file and obtain control over an application subsequent to increasing remote code execution rights on the objective’s Struts-based application server.

Due to the severity of the vulnerability Man Yue he didn’t disclose more details about this vulnerability.He reported the Vulnerability to the vendor on 17 July 2017 and it has been fixed with Struts version 2.5.13 released yesterday.

This new version contains a fix for many security vulnerabilities.

  • CVE-2017-9793 – DoS attack is possible when using outdated XStream library with the Struts REST plugin
  • CVE-2017-9804 – Possible DoS attack when using URLValidator

Now the version has been published, Server administrators are strongly advised to update their Apache Struts as soon as possible.

Website

Latest articles

1inch partners with Blockaid to enhance Web3 security through the 1inch Shield

1inch, a leading DeFi aggregator that provides advanced security solutions to users across the...

Hackers Exploit Progressive Web Apps to Steal Passwords

In a concerning development for cybersecurity, hackers are increasingly leveraging Progressive Web Apps (PWAs)...

INE Security: Optimizing Teams for AI and Cybersecurity

2024 is rapidly shaping up to be a defining year in generative AI. While...

Threat Actor Claims Breach of Jollibee Fast-Food Gaint

A threat actor has claimed responsibility for breaching the systems of Jollibee Foods Corporation,...

Threat Actors Claiming Breach of Accenture Employee Data

Threat actors have claimed responsibility for a significant data breach involving Accenture, one of...

Diamorphine Rootkit Exploiting Linux Systems In The Wild

Threat actors exploit Linux systems because they are prevalent in organizations that host servers,...

Amtrak Data Breach: Hackers Accessed User’s Email Address

Amtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles