Blog

Pradeep Kulkarni
CVE-2017-9805 | Apache Struts 2 Remote Code Execution Vulnerability – An analysis by Quick Heal Security Labs
September 7, 2017

apache-struts-2-remote-code-execution-vulnerability

A critical remote code execution vulnerability has been discovered in the popular web application framework Apache Struts, which allows attackers to execute an arbitrary code. To address this issue, Apache Struts has issued a security advisory and CVE-2017-9805 has been assigned to it. The attacker may use this vulnerability to target organizations across the globe. Web applications running on Apache Struts framework which uses REST (Representational State Transfer) plugin are affected by this vulnerability.

Vulnerable versions

  • Struts 2.5 – Struts 2.5.12

Vulnerability

The root cause of this vulnerability lies in handling of deserializes input data by the REST plugin of Apache Struts application. This vulnerability allows remote attackers to perform a remote code execution by sending crafted POST request. The attackers can embed commands into vulnerable field of POST request body. The vulnerability is triggered while processing a crafted POST request having header ‘Content-Type’ set to ‘application/xml’.

We reproduced the vulnerability by using a readily available Metasploit compatible POC.  Below is the traffic captured denoting the crafted POST request which triggers the vulnerability.

fig_1_1

Fig 1. Vulnerability Trigger

Fig 1. Vulnerability Trigger

 

Fig 2. Payload drop at /tmp location on server

Fig 2. Payload drop at /tmp location on server

Quick Heal detection

Quick Heal has released the following IPS detection for the vulnerability CVE-2017-9805.

  • VID-03103: Apache Struts Remote Command Execution

This critical vulnerability has been patched by Apache Struts. We strongly recommend users to upgrade their Apache Struts installation to 2.3.34 and 2.5.13 as per the advisory and also apply the latest security updates by Quick Heal.

References

https://lgtm.com/blog/apache_struts_CVE-2017-9805
https://struts.apache.org/docs/s2-052.html
https://github.com/rapid7/metasploit-framework/pull/8924/files

Also Read: CVE-2017-5638 – Apache Struts 2 Remote Code Execution Vulnerability 

Subject Matter Experts

  • Aniruddha Dolas, Pallavi Pangavhane | Quick Heal Security Labs

Have something to add to this story? Share it in the comments.

Pradeep Kulkarni
About Pradeep Kulkarni
Pradeep Kulkarni is leading the IPS team in Quick Heal Technologies Limited. Having worked in the IT security industry for over 11 years, he has worked on various...
Articles by Pradeep Kulkarni »

No Comments, Be The First!

Your email address will not be published.

CAPTCHA Image