UDTSecure™ Threat Advisory: 1037973 / Apache Struts 2

Overview
An unauthenticated remote code execution vulnerability in the Apache Struts 2 package has been publicly reported which allows a remote user to execute arbitrary commands on target systems.

The vulnerability allows an unauthenticated attacker to execute code remotely on a vulnerable system through the use of a specially crafted Content-Type header. The attack code will be executed with the permission of the web server user. Attack tools exist publicly and this vulnerability is being actively exploited.

Details
CVE Reference: CVE-2017-5638
Date: March 9th, 2017
Reissue Date: September 18th, 2017
Status: Confirmed
Fix Available: Yes
Impact: Possible Remote Code Execution when performing file uploads based on Apache Struts Jakarta Multipart parser.
Security Rating: CRITICAL

Affected Software
Struts 2.3.5 – Struts 2.3.31, Struts 2.5 – Struts 2.5.10

Recommended Remediation
Upgrade to Struts 2.3.32 or Struts 2.5.10.1. Visit the vendor’s website struts.apache.org/docs/s2-045.html for more information regarding this vulnerability.

Underlying Affected Products
Underlying products or system components from other vendors can potentially be affected by this vulnerability. Table 1 below provides a listing of those vendors who have issued fixes for affected products potentially vulnerable to exploits described in this advisory.

We highly recommend you visit the vendor’s website for those products and or system components that are applicable to your environment and infrastructure for more specific information on how best to fix the vulnerability.

VENDOR	PRODUCTS	WEBSITE
Cisco	Various	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2
VMWare	Various	http://www.vmware.com/security/advisories/VMSA-2017-0004.html
HPE	Universal Configuration Management Database	https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03733en_us
HPE	HPe Server Automation	http://h20565.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03749en_us
Oracle	WebLogic Fusion Middleware Siebel Enterprise	http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html

Accomplish More With UDT

Get your custom solution in cybersecurity, lifecycle management, digital transformation and managed IT services. Connect with our team today.

More to explore

2024 Will Test Cybersecurity Leaders: Is Your Company Ready?

Experts say new AI-driven threats and an election year will spell trouble for companies.

K12 Budgeting: Planning Your 1:1 Device Refresh Program Cost

As K12 education evolves, managing 1:1 device programs effectively is crucial. These programs, providing each student with a personal computing device, play a pivotal role in modern education. Success demands strategic planning, communication, foresight, and a holistic approach to device management. With digital learning on the rise, these devices are more than just tools for accessing information; they are platforms for interactive, core learning experiences. However, funding remains a significant hurdle, making effective budgeting for your device refresh program essential for optimizing ROI and device longevity.

Crafting a Futureproof 1:1 Device Strategy for School Districts

In the evolving landscape of Education Technology, crafting a futureproof 1:1 device strategy is crucial. This strategy should link every student, teacher, and administrator experience with specific device specifications. The integration of educational apps into the curriculum can significantly enhance the learning environment. These apps, tailored to the needs of students, can provide interactive content, fostering a dynamic learning experience.

Optimizing Your K12 Tech Investments: Funding 1:1 Device Programs

This blog will guide school districts grappling with the financial and resource demands of implementing a successful 1:1 device program amid ongoing challenges of budget constraints and competing priorities. Our guided workbook, created in partnership with Intel, provides further support with personalized roadmap on “Pathways to Innovation: Building a Sustainable Digital Learning Environment”.

K12 Cybersecurity: How to Secure 1:1 Devices in Your School District

This blog post delves into the importance of security, cybersecurity, and data privacy in school districts implementing 1:1 device initiatives. It offers basic steps for evaluating, planning, and executing a security strategy. Our guided workbook, created in partnership with Intel, provides a personalized roadmap on “Pathways to Innovation: Building a Sustainable Digital Learning Environment”.

Lost & Stolen Devices are a Serious Data Security Threat—Here’s Why

Since the pandemic, remote and hybrid work has become the norm. While mobile devices and remote workstations have empowered great flexibility, it has also led to an increase in data security problems due to lost, misplaced, or stolen devices. Find out how remote and hybrid setups are contributing to this problem and how to protect yourself and your organization.