Detecting Apache Struts 2 Namespace RCE | Qualys
Summary: Qualys reported on CVE-2018-11776, a remote code execution vulnerability in Apache Struts 2 disclosed the prior day, caused by improper namespace validation that allows OGNL injection and can lead to full remote code execution on the target system. Struts versions 2.3.34 and 2.5.16 and before are impacted, patched versions are 2.3.35 and 2.5.17, and a publicly available PoC has already been published.
Key Takeaway: A public proof-of-concept is already out and active attacks are described as most likely imminent, while the flaw exists in commonly seen configurations for some Struts plugins rather than only unusual setups. Qualys notes that framework vulnerabilities are hard to detect with traditional VM scanning, so it implemented multiple QIDs and recommends documenting frameworks in an Application Portfolio or CMDB.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-11776CVE-2018-7600
- Related
- CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021