Content-Type: Malicious - New Apache Struts2 0-day Under Attack
Summary: Cisco Talos reported active exploitation of CVE-2017-5638, a remote code execution bug in the Jakarta Multipart parser in Apache Struts, with a high number of exploitation events observed. Most attempts used a publicly released PoC to run commands ranging from 'whoami' and 'ifconfig' to disabling Linux and SUSE firewalls and downloading and executing malicious ELF payloads including an IRC bouncer, a DoS bot, and a sample related to the bill gates botnet.
What you should know: The exploit is trivial enough that a public PoC published on the afternoon of 03-07-2017 was followed by immediate and steady exploitation, and Talos observed attempts to establish persistence and disable firewalls on boot - so any unpatched Struts instance should be treated as already probed.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2017-5638
- Related
- CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021