Another Apache Struts Vulnerability Under Active Exploitation
Summary: Cisco Talos reported that CVE-2017-9805, a critical Apache Struts flaw in the REST plugin's use of XStreamHandler for deserialization without type filtering, allows a remote, unauthenticated attacker to achieve remote code execution. Within 48 hours of disclosure, Talos observed exploitation activity similar to the March 2017 CVE-2017-5638 attacks, with most attempts POSTing to /struts2-rest-showcase/orders/3 and sending data to wildkind[.]ru, an IP also associated with 188.120.246[.]215.
Why it matters: Exploit code was developed and in use within 48 hours of disclosure, even though a patch was available before the flaw went public - and Talos notes response windows have shrunk from weeks to days or hours.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-5638CVE-2017-9805
- Related
- CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021