CVE-2018-11776—The latest Apache Struts vulnerability

About a week ago, a security researcher disclosed a critical remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers. The vulnerability (CVE-2018-11776) affects all supported versions of Struts 2 and was patched by the Apache Software Foundation on Aug. 22. Users of Struts 2.3 should upgrade to 2.3.35; users of Struts 2.5 need to upgrade to 2.5.17. They should do so as soon as possible, given that bad actors are already working on exploits.

More critical than the Equifax vulnerability

“On the whole, this is more critical than the highly critical Struts RCE vulnerability that the Semmle Security Research Team discovered and announced last September,” Man Yue Mo, the researcher who uncovered the flaw, told the media, referring to the vulnerability (CVE-2017-5638) that hackers used to compromise Equifax last year, which led to the lifting of personal details of over 148 million consumers.

Struts, an open source framework for developing web applications, is widely used by enterprises worldwide, including Fortune 100 companies like Lockheed Martin and Virgin Atlantic, as well as the U.S. Internal Revenue Service.

In 2017, the Equifax credit reporting agency used Struts in an online portal, and because Equifax did not identify and patch a vulnerable version of Struts, attackers were able to capture personal consumer information such as names, Social Security numbers, birth dates, and addresses of over 148 million U.S. consumers, nearly 700,000 U.K. residents, and more than 19,000 Canadian customers.

“Modern software is increasingly complex, and identifying how data passes through it should be a priority for all software development teams.”

Insight on CVE-2018-11776

I spoke to Black Duck by Synopsys technical evangelist Tim Mackey about the newly discovered Struts vulnerability. “Modern software is increasingly complex, and identifying how data passes through it should be a priority for all software development teams,” Tim noted. “To give you some background, developers commonly use libraries of code, or development paradigms which have proven efficient, when creating new applications or features. This attribute is a positive when the library or paradigm is of high quality, but when a security defect is uncovered, this same attribute often leads to a pattern of security issues.

“In the case of CVE-2018-11776,” Tim continued, “the root cause was a lack of input validation on the URL passed to the Struts framework. In both 2016 and 2017, the Apache Struts community disclosed a series of remote code execution vulnerabilities. These vulnerabilities all related to the improper handling of unvalidated data. However, unlike CVE-2018-11776, the prior vulnerabilities were all in code within a single functional area of the Struts code. This meant that developers familiar with that functional area could quickly identify and resolve issues without introducing new functional behaviors.

“CVE-2018-11776, on the other hand, operates at a far deeper level within the code, which in turns requires a deeper understanding of not only the Struts code itself but the various libraries used by Struts. It is this level of understanding which is of greatest concern—and this concern relates to any library framework. Validating the input to a function requires a clear definition of what is acceptable. It equally requires that any functions available for public use document how they use the data passed to them. Absent the contract such definitions and documentation form, it’s difficult to determine if the code is operating correctly or not. This contract becomes critical when patches to libraries are issued, as it’s unrealistic to assume that all patches are free from behavioral changes.”

Shortly after the Apache Software Foundation released its patch, a proof-of-concept exploit of the vulnerability was posted on GitHub. The PoC included a Python script that allows for easy exploitation. The firm that discovered the PoC, threat intelligence company Recorded Future, also said that it has spotted chatter on underground forums revolving around the flaw’s exploitation. Companies not wanting to become the next Equifax should immediately identify what version of Apache Struts they have in use and where, and apply the patch as needed.

Secure and manage the open source in your applications and containers.

Learn more about Black Duck now.