CVE-2017-5638
published 2017-03-11CVE-2017-5638: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
100.00%
100.0th percentile
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | >= 2.2.3 < 2.3.32 | 2.3.32 |
| apache | struts | >= 2.5.0 < 2.5.10.1 | 2.5.10.1 |
| apache_software_foundation | apache_struts | — | — |
| apache_software_foundation | apache_struts | — | — |
| arubanetworks | clearpass_policy_manager | < 6.6.5 | 6.6.5 |
| cisco | products | — | — |
| hp | server_automation | — | — |
| hp | server_automation | — | — |
| hp | server_automation | — | — |
| hp | server_automation | — | — |
| hp | server_automation | — | — |
| ibm | storwize_v3500_firmware | — | — |
| ibm | storwize_v3500_firmware | — | — |
| ibm | storwize_v5000_firmware | — | — |
| ibm | storwize_v5000_firmware | — | — |
| ibm | storwize_v7000_firmware | — | — |
| ibm | storwize_v7000_firmware | — | — |
| lenovo | storage_v5030_firmware | — | — |
| lenovo | storage_v5030_firmware | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by inspecting HTTP Content-Type, Content-Disposition, and Content-Length headers for OGNL expressions (e.g., #cmd=, #context[...]) sent to Struts endpoints (.action, .do). ↗
- →Authentication is not required to exploit this flaw; treat all unauthenticated requests with OGNL expressions in Content-Type headers as high-priority alerts. ↗
- →The detection method sends a crafted Content-Type header with an OGNL math expression; a correct computed answer (e.g., 16256160 for 3195*5088) returned in the HTTP response header confirms the server is vulnerable. ↗
- →Post-exploitation, threat actors have been observed downloading Monero cryptocurrency miners from a single malicious domain; monitor for outbound connections to unknown domains following Struts exploitation and for miner processes. ↗
- ·Affected versions are Apache Struts 2.3.5–2.3.31 and 2.5–2.5.10; versions 2.3.32 and 2.5.10.1 are patched. Scans should target the specific vulnerable version range. ↗
- ·Nessus remote plugin 97610 depends on webmirror crawling to discover target URLs; if the web app uses non-default paths or complex authentication, the crawler may miss vulnerable endpoints and manual URL specification is required. ↗
- ·Local authenticated plugin 97576 only runs when the Nessus scan Accuracy setting is configured to 'Show potential false alarms'; ensure this setting is enabled for authenticated scans. ↗
- ·Qualys VM QID 11771 is most effective when form-based authentication is not required and default Struts .action/.do paths are used; for non-default paths or complex auth, WAS QID 150173 should be used instead. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_cisco9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache Struts Remote Code Execution Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2017-5638 [CRITICAL] CWE-20 Apache Struts Remote Code Execution Vulnerability
Vulnerability: Apache Struts Remote Code Execution Vulnerability
Affected: Apache Struts
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-5638
Remediation Due Date: 2022-05-03
Cisco
Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
vendor_cisco·2017-03-11·CVSS 9.8
CVE-2017-5638 [CRITICAL] CWE-20 Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
On March 6, 2017, Apache disclosed a vulnerability in the Jakarta Multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on a targeted system by using a crafted Content-Type, Content-Disposition, or Content-Length value.
This vulnerability has been assigned CVE-ID CVE-2017-5638.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2
Red Hat
struts2: RCE when performing file upload based on Jakarta Multipart parser
vendor_redhat·2017-03-06·CVSS 9.8
CVE-2017-5638 [CRITICAL] CWE-20 struts2: RCE when performing file upload based on Jakarta Multipart parser
struts2: RCE when performing file upload based on Jakarta Multipart parser
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
A flaw was reported in Apache Struts 2 that could allow an attacker to perform remote code execution with a malicious Content-Type value.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier
Cisco
Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
vendor_cisco
CVE-2017-5638 Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
CVE-2017-5638: Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
On March 6, 2017, Apache disclosed a vulnerability in the Jakarta Multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on a targeted system by using a crafted Content-Type , Content-Disposition , or Content-Length value. This vulnerability has been assigned CVE-ID CVE-2017-5638. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2
CWE: CWE-20, CWE-20
Bug IDs: CSCvd49788, CSCvd49817, CSCvd49829, CSCvd49788, CSCvd49817
OSV
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
osv·2018-10-18
CVE-2017-5638 [CRITICAL] Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
GHSA
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
ghsa·2018-10-18
CVE-2017-5638 [CRITICAL] CWE-20 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
VulnCheck
Apache Struts Remote Code Execution Vulnerability
vulncheck·2017·CVSS 9.8
CVE-2017-5638 [CRITICAL] CWE-20 Apache Struts Remote Code Execution Vulnerability
Apache Struts Remote Code Execution Vulnerability
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Affected: Apache Struts
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2017-5638; https://www.f5.com/labs/articles/threat-intelligence/from-ddos-to-server-ransomware-apache-struts-2-cve-2017-5638-campaign-25922; https://isc.sans.edu/diary/Java+Struts2+Vulnerability+Used+To+Install+Cerber+Crypto+Ransomware/22264; https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/2017-notable-vulnerabilities-and-exploits; https://cisa.gov/news-events/ics-alerts/ics-alert-14-281-01; http
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1
suricata·2017-03-20·CVSS 9.8
CVE-2017-5638 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1"; flow:established,to_server; http.header; content:"multipart/form-data"; nocase; http.request_body; content:"Content-Disposition|3a|"; nocase; content:"filename"; nocase; pcre:"/^[^\r\n]*filename\s*=\s*[^\x3b\x3a\r\n]*[\x25\x24]\s*\{[^\r\n]{20,}\}/mi"; reference:url,community.hpe.com/t5/Security-Research/Struts2-046-A-new-vector/ba-p/6949723#.WNF-_kcpDUJ; classtype:web-application-attack; sid:2024096; rev:5; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_03_20, deployment
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3
suricata·2017-03-13·CVSS 9.8
CVE-2017-5638 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3"; flow:established,to_server; http.header; header_lowercase; content:"content-type|3a 20 25 7b 28 23|"; nocase; fast_pattern; content:"multipart/form-data"; classtype:web-application-attack; sid:2024045; rev:5; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_03_13, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_04_28;)
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2
suricata·2017-03-10·CVSS 9.8
CVE-2017-5638 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2"; flow:established,to_server; http.content_type; content:"multipart/form-data"; content:"{"; distance:0; content:"}"; distance:15; classtype:web-application-attack; sid:2024044; rev:5; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2017_03_10, cve CVE_2017_5638, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2020_08_20;)
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)
suricata·2017-03-08·CVSS 9.8
CVE-2017-5638 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)"; flow:established,to_server; http.header; content:"apache"; http.content_type; content:"ProcessBuilder"; content:".struts"; distance:0; reference:cve,2017-5638; reference:url,github.com/rapid7/metasploit-framework/issues/8064; classtype:web-application-attack; sid:2024038; rev:4; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_03_08, cve CVE_2017_5638, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2020_08_20;)
Sigma
Potential OGNL Injection Exploitation In JVM Based Application
sigma·CVSS 9.8
CVE-2017-5638 [CRITICAL] Potential OGNL Injection Exploitation In JVM Based Application
Potential OGNL Injection Exploitation In JVM Based Application
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detection:
condition: keywords
keywords:
- org.apache.commons.ognl.OgnlException
- ExpressionSyntaxException
Log Source: category: application
definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR
and above)'
product: jvm
Exploit-DB
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit)
exploitdb·2017-03-15
CVE-2017-5638 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit)
Apache Struts 2.3.5 'Apache Struts Jakarta Multipart Parser OGNL Injection',
'Description' => %q{
This module exploits a remote code execution vunlerability in Apache Struts
version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed
via http Content-Type header.
Native payloads will be converted to executables and dropped in the
server's temp dir. If this fails, try a cmd/* payload, which won't
have to write to the disk.
},
'Author' => [
'Nike.Zheng', # PoC
'Nixawk', # Metasploit module
'Chorder', # Metasploit module
'egypt', # combining the above
'Jeffrey Martin', # Java fu
],
'References' => [
['CVE', '2017-5638'],
['URL', 'https://cwiki.apache.org/confluence/display/WW/S2-045']
],
'Privileged' => true,
'Targets' => [
[
'Universal', {
'Platform' => %w{ unix windows
Exploit-DB
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution
exploitdb·2017-03-07
CVE-2017-5638 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution
Apache Struts 2.3.5 ")
else:
print('[*] CVE: 2017-5638 - Apache Struts2 S2-045')
url = sys.argv[1]
cmd = sys.argv[2]
print("[*] cmd: %s\n" % cmd)
exploit(url, cmd)
Metasploit
Apache Struts Jakarta Multipart Parser OGNL Injection
metasploit
Apache Struts Jakarta Multipart Parser OGNL Injection
Apache Struts Jakarta Multipart Parser OGNL Injection
This module exploits a remote code execution vulnerability in Apache Struts version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed via http Content-Type header. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cmd/* payload, which won't have to write to the disk.
Nuclei
Apache Struts 2 - Remote Command Execution
nuclei·CVSS 9.8
CVE-2017-5638 [CRITICAL] Apache Struts 2 - Remote Command Execution
Apache Struts 2 - Remote Command Execution
Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header. This was exploited in March 2017 with a Content-Type header containing a #cmd= string.
Template:
id: CVE-2017-5638
info:
name: Apache Struts 2 - Remote Command Execution
author: Random_Robbie
severity: critical
description: |
Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect ex
arXiv
SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models
arxiv_fulltext·2026-02-10
SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models
## Abstract
AI coding assistants produce vulnerable code in 45% of security-relevant scenarios , yet no public training dataset teaches both traditional web security and AI/ML-specific defenses in a format suitable for instruction tuning. We present SecureCode, a production-grade dataset of 2,185 multi-turn security training examples spanning two domains: web application security (1,435 examples covering the OWASP Top 10 2021 across 11 languages and 9 frameworks, 100% grounded in documented CVEs and security incidents) and AI/ML security (750 examples covering all 10 OWASP LLM Top 10 2025 categories across 40+ frameworks including LangChain, OpenAI, and HuggingFace). Every example follows a 4-turn conversational structure---feature request, vulnerable and secure implementations with attac
arXiv
Incalmo: An Autonomous LLM-assisted System for Red Teaming Multi-Host Networks
arxiv_fulltext·2025-11-22
Incalmo: An Autonomous LLM-assisted System for Red Teaming Multi-Host Networks
[0] et al.,
[0] e.g.,
[0] i.e.,
[1] Table
[1] Fig.
[1] Sec.
[1] Appendix
[1] Finding
[0] Incalmo
[0] Incalmo-WHT
[0] Incalmo-WS
[0] MHBench
[0] ExpertPromptShell
Success
TotalAcquisition
Reliability
[1] #1.
[1] #1:
[1] #1
[1]red (vs: #1)
[1]blue (Lujo: #1)
[1]magenta (Brian: #1)
finding
finding[2]
finding
@edef\@currentlabel#1
tcolorbox
Finding #1: #2
tcolorbox
limitation
limitation[2]
limitation
@edef\@currentlabelFailure mode
tcolorbox
#1 (Failure mode ): #2
tcolorbox
.2mm
challenge
challenge[1]
challenge
@edef\@currentlabelname#1
0.2cm
1mm
tcolorbox
Challenge : #1
tcolorbox
.2mm
packeditemizeitemize1
[packeditemize]
label= ,
[1] 0em#10em
[1]
#1
myquote
=0.12in =0.12in
- :
* [1] [baseline=(char.base)]
[shape=circle,text=white,fill=black,draw,inner sep=1pt]
arXiv
PentestMCP: A Toolkit for Agentic Penetration Testing
arxiv_fulltext·2025-10-04
PentestMCP: A Toolkit for Agentic Penetration Testing
0.95
0.95
0.05
0.9
0.95
0.9
nmap
metasploit
meterpreter
nuclei
curl
empty
-0.10in
empty
PentestMCP: A Toolkit for Agentic Penetration Testing
tabular[t]cc
Zachary Ezetta & Wu-chang Feng
[email protected] & [email protected]
tabular
Portland State University
Department of Computer Science
## Abstract
Agentic AI is transforming security by automating many tasks being performed manually. While initial agentic approaches employed a
monolithic architecture, the Model-Context-Protocol has now enabled a remote-procedure call (RPC) paradigm to agentic applications, allowing for
the flexible construction and composition of multi-function agents. This paper describes PentestMCP, a library of MCP server implementations that support agentic penetration testing. By supporting common penetration
arXiv
Perry: A High-level Framework for Accelerating Cyber Deception Experimentation
arxiv_fulltext·2025-09-25
Perry: A High-level Framework for Accelerating Cyber Deception Experimentation
Perry
: A High-level Framework for
Accelerating Cyber Deception Experimentation
Brian Singer
Carnegie Mellon University
Yusuf Saquib
Carnegie Mellon University
Lujo Bauer
Carnegie Mellon University
Vyas Sekar
Carnegie Mellon University
## Abstract
Cyber deception aims to distract, delay, and detect network attackers with fake assets such as honeypots, decoy credentials, or decoy files.
However, today, it is difficult for operators to experiment, explore, and evaluate deception approaches.
Existing tools and platforms have non-portable and complex implementations that are difficult to modify and extend.
We address this pain point by introducing Perry, a high-level framework that accelerates the design and exploration of deception what-if scenarios.
Perry has two components: a high-le
arXiv
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
arxiv_fulltext·2025-08-14
Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations
-30pt
footnote0
## Abstract
Advances in artificial intelligence are widely understood to have implications for cybersecurity. Articles have emphasized the effect of AI on the cyber offense-defense balance, and credible commentators can be found arguing either that cyber will privilege attackers or defenders. For defenders, arguments are often made that AI will enable solutions like formal verification of all software—and for some well-equipped companies, this may be true. This conversation, however, does not match the reality for most companies. ``Trailing-edge organizations,'' as we term them, rely heavily on legacy software, poorly staff security roles, and struggle to implement best practices like rapid deployment of security patches. These decisions may be the result of corporate ine
arXiv
TELSAFE: Security Gap Quantitative Risk Assessment Framework
arxiv_fulltext·2025-07-09
TELSAFE: Security Gap Quantitative Risk Assessment Framework
TELSAFE: Security Gap Quantitative Risk Assessment Framework
%Based on Event Tree Modeling
Sarah Ali Siddiqui1E-mail:[email protected], Chandra Thapa1, Derui Wang1, Rayne Holland1, Wei Shao1, Seyit Camtepe1, Hajime Suzuki1
and Rajiv Shah2
1CSIRO Data61, Sydney, Australia
2MDR Security, Canberra, Australia
## Abstract
Gaps between established security standards and their practical implementation have the potential to introduce vulnerabilities
, possibly exposing them to security risks. To effectively address and mitigate these security and compliance challenges, security risk management strategies are essential.
However, it must adhere to well-established strategies and industry standards to ensure consistency, reliability, and compatibility both within and across organiza
arXiv
PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
arxiv_fulltext·2025-05-29
PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
PentestAgent: Incorporating LLM Agents to Automated Penetration Testing
Xiangmin Shen
Northwestern University
Evanston
Illinois
USA
[email protected]
Both authors contributed equally to this work.
Lingzhi Wang
Northwestern University
Evanston
Illinois
USA
[email protected]
[1]
Zhenyuan Li
Zhejiang University
Hangzhou
Zhejiang
China
[email protected]
Yan Chen
Northwestern University
Evanston
Illinois
USA
[email protected]
Wencheng Zhao
Ant Group
Hangzhou
Zhejiang
China
[email protected]
Dawei Sun
Ant Group
Hangzhou
Zhejiang
China
[email protected]
Jiashui Wang
Zhejiang University
Hangzhou
Zhejiang
China
[email protected]
Wei Ruan
Zhejiang University
Hangzhou
Zhejiang
China
[email protected]
Shen et al.
## Abstract
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
arxiv_fulltext·2024-07-31
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Raveen Kanishka Jayalath*
University of Adelaide, Australia
[email protected]
Hussain Ahmad* *Authors contributed equally to this work. Corresponding author.
University of Adelaide, Australia
[email protected]
Diksha Goel
CSIRO's Data61, Australia
[email protected]
3cmMuhammad Shuja Syed
3cmSLB, USA
[email protected]
Faheem Ullah
University of Adelaide, Australia
[email protected]
plain
## Abstract
Microservice architectures are revolutionizing both small businesses and large corporations, igniting a new era of innovation with their exceptional advantages in maintainability, reusability, and scalability. However, these benefits come w
arXiv
NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation
arxiv_fulltext·2023-11-04
NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation
: An Online System for Fine-Grained APT Attack Detection and Investigation
Shaofei Li2,
Feng Dong3,
Xusheng Xiao4,
Haoyu Wang3,
Fei Shao5,
Jiedong Chen6, Yao Guo2,
Xiangqun Chen2, and Ding Li* is the corresponding author.21
2Key Laboratory of High-Confidence Software Technologies (MOE), School of Computer Science, Peking University
3Huazhong University of Science and Technology7 7 Hubei Key Laboratory of Distributed System Security, Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology., 4Arizona State University
5Case Western Reserve University, 6Sangfor Technologies Inc.
2\lishaofei, ding_li, yaoguo, cherry\@pku.edu.cn, 3\dongfeng, haoyuwang\@hust.edu.cn
[email protected], [email protected], 6che
arXiv
VulCurator: A Vulnerability-Fixing Commit Detector
arxiv_fulltext·2022-09-07
VulCurator: A Vulnerability-Fixing Commit Detector
[: A Vulnerability-Fixing Commit Detector]: A Vulnerability-Fixing Commit Detector
Truong-Giang Nguyen
Singapore Management University
Singapore
Singapore
[email protected]
Thanh Le-Cong
Singapore Management University
Singapore
Singapore
[email protected]
Hong Jin Kang
Singapore Management University
Singapore
Singapore
[email protected]
Xuan-Bach D. Le
University of Melbourne
Melbourne
Australia
[email protected]
David Lo
Singapore Management University
Singapore
Singapore
[email protected]
[1]red #1
[1]blue Bach : #1
[1]blue HJ : #1
acmlicensed
15.00
10.1145/3540250.3558936
2022
2022
fse22demo-p103-p
978-1-4503-9413-0/22/11
[ESEC/FSE '22]Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Sof
arXiv
SPI: Automated Identification of Security Patches via Commits
arxiv_fulltext·2021-06-06
SPI: Automated Identification of Security Patches via Commits
SPI: Automated Identification of Security Patches via Commits
Yaqin Zhou
indicate equal contribution
[email protected]
Nanyang Technological University
Singapore
Jing Kai Siow
[1]
Nanyang Technological University
Singapore
[email protected]
Chenyu Wang
Nanyang Technological University
Singapore
[email protected]
Shangqing Liu
Nanyang Technological University
Singapore
[email protected]
Yang Liu
Nanyang Technological University
Singapore
[email protected]
## Abstract
Security patches in open-source software, providing security fixes to identified vulnerabilities, are crucial in protecting against cyber attacks. Security advisories and announcements are often publicly released to inform the users about potential security vulnerability. Despite the National Vul
arXiv
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
arxiv_fulltext·2021-02-10·CVSS 8.8
CVE-2017-11882 [HIGH] Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
Top 10 Most Exploited Vulnerabilities 2016-2019
(https://us-cert.cisa.gov/ncas/alerts/aa20-133a)
.83fcdec8a329824466f140a2e6cdfeec473a9ee2 .0
longtable[]@lllllll@
& CVSS Score & Number of Tactics & Number of Techniques &
Number of CAPECs & Number of CWEs & Number of CPEs
CVE-2017-11882 & 8.55 & 0 & 0 & 12 & 1 & 4
CVE-2017-0199 & 8.55 & 0 & 0 & 0 & 0 & 9
CVE-2017-5638 & 10.0 & 1 & 3 & 51 & 1 & 53
CVE-2012-0158 & 9.3 & 0 & 0 & 3 & 1 & 29
CVE-2019-0604 & 8.65 & 1 & 3 & 51 & 1 & 4
CVE-2017-0143 & 0.0 (not listed in BRON but NVD says high severity)
& 0 & 0 & 0 & 0 & 0
CVE-2018-4878 & 8.65 & 0 & 0 & 0 & 1 & 3
CVE-2017-8759 & 8.55 & 1 & 3 & 51 & 1 & 8
CVE-2015-1641 & 9.3 & 0 & 0 & 0 & 1 & 11
CVE-2018-7600 & 8.65 & 1 & 3 & 51 & 1 & 4
longtable
4 out of Top 10 Vulnerabilities share the follow
arXiv
AppMine: Behavioral Analytics for Web Application Vulnerability Detection
arxiv_cs_cr·2019-08-06·CVSS 9.8
[CRITICAL] AppMine: Behavioral Analytics for Web Application Vulnerability Detection
AppMine: Behavioral Analytics for Web Application Vulnerability Detection
Web applications in widespread use have always been the target of large-scale attacks, leading to massive disruption of services and financial loss, as in the Equifax data breach. It has become common practice to deploy web application in containers like Docker for better portability and ease of deployment. We design a system called AppMine for lightweight monitoring of web applications running in Docker containers and detection of unknown web vulnerabilities. AppMine is an unsupervised learning system, trained only on legitimate workloads of web application, to detect anomalies based on either traditional models (PCA and one-class SVM), or more advanced neural-network architectures (LSTM). In our evaluation, we dem
arXiv
AppMine: Behavioral Analytics for Web Application Vulnerability Detection
arxiv_fulltext·2019-08-06·CVSS 9.8
[CRITICAL] AppMine: Behavioral Analytics for Web Application Vulnerability Detection
2019
2019
acmcopyright
[CCSW '19]The ACM Cloud Computing Security WorkshopNovember 11, 2019London, UK
2019 ACM Cloud Computing Security Workshop (CCSW 2019), November 11, 2019, London, UK
## Abstract
Web applications in widespread use have always been the target of large-scale attacks, leading to massive disruption of services and financial loss, as in the Equifax data breach. It has become common practice to deploy web application in containers like Docker for better portability and ease of deployment. We design a system called \ for lightweight monitoring of web applications running in Docker containers and detection of unknown web vulnerabilities. \ is an unsupervised learning system, trained only on legitimate workloads of web application, to detect anomalies based on either traditio
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
arXiv
Tiresias: Predicting Security Events Through Deep Learning
arxiv_fulltext·2019-05-24
Tiresias: Predicting Security Events Through Deep Learning
et al.
e.g.,
i.e.,
10.1145/3243734.3243811
2018
2018
acmlicensed
[CCS '18]2018 ACM SIGSAC Conference on Computer and Communications SecurityOctober 15--19, 2018Toronto, ON, Canada
2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18), October 15--19, 2018, Toronto, ON, Canada
15.00
: Predicting Security Events Through Deep Learning
Yun Shen^ , Enrico Mariconti^ , Pierre-Antoine Vervier^ , and Gianluca Stringhini^
^ Symantec Research Labs, ^ University College London, ^ Boston University
\yun_shen,pierre-antoine_vervier\@symantec.com, [email protected], [email protected]
## Abstract
With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps tha
arXiv
On Preempting Advanced Persistent Threats Using Probabilistic Graphical Models
arxiv_fulltext·2019-03-21
On Preempting Advanced Persistent Threats Using Probabilistic Graphical Models
On Preempting Advanced Persistent Threats Using Probabilistic Graphical Models
Phuong Cao
University of Illinois at Urbana-Champaign
## Abstract
This paper presents PULSAR, a framework for
preempting Advanced Persistent Threats (APTs). PULSAR employs a probabilistic
graphical model (specifically a Factor Graph) to infer the time evolution of an attack based on observed security events at runtime. The framework
enumerate*[label=( *)]
- learns the statistical significance of patterns of events from past attacks;
- composes these patterns into FGs to capture the progression of the attack; and
- decides on preemptive actions.
enumerate*
The accuracy of our approach and its performance are evaluated in three experiments at SystemX:
enumerate*[label=( *)]
- a study with a dataset containi
arXiv
Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
arxiv_fulltext·2018-07-12
Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
## Abstract
The use of open-source software (OSS) is ever-increasing, and so is the number of open-source vulnerabilities being discovered and publicly disclosed. The gains obtained from the reuse of community-developed libraries may be offset by the cost of timely detecting, assessing, and mitigating their vulnerabilities.
In this paper we present a novel method to detect, assess and mitigate OSS vulnerabilities that improves on state-of-the-art approaches, which commonly depend on metadata to identify vulnerable OSS dependencies. Our solution instead is code-centric and combines static and dynamic analysis to determine the reachability of the vulnerable portion of libraries used (directly or transitively) by an application. Taking this usage into account, our approach then supports dev
CTF
Web_Exploitation / JAuth
ctf_writeups·CVSS 9.8
[CRITICAL] Web_Exploitation / JAuth
# JAuth
- [Challenge information](#challenge-information)
- [Solution](#solution)
- [References](#references)
## Challenge information
```text
Level: Medium
Tags: picoGym Exclusive, Web Exploitation
Meta Tags: Walkthrough, Walk-through, Write-up, Writeup
Author: GEOFFREY NJOGU
Description:
Most web application developers use third party components without testing their security.
Some of the past affected companies are:
* Equifax (a US credit bureau organization) - breach due to unpatched Apache Struts web framework CVE-2017-5638
* Mossack Fonesca (Panama Papers law firm) breach - unpatched version of Drupal CMS used
* VerticalScope (internet media company) - outdated version of vBulletin forum software used
Can you identify the components and exploit the vulnerable one?
The website i
CTF
AdventOfCyber / README
ctf_writeups
AdventOfCyber / README
# Day1 Inventory Management
```
Elves needed a way to submit their inventory - have a web page where they submit their requests and the elf mcinventory can look at what others have submitted to approve their requests. It’s a busy time for mcinventory as elves are starting to put in their orders. mcinventory rushes into McElferson’s office.
I don’t know what to do. We need to get inventory going. Elves can log on but I can’t actually authorise people’s requests! How will the rest start manufacturing what they want.
McElferson calls you to take a look at the website to see if there’s anything you can do to help. Deploy the machine and access the website at http://:3000 - it can take up to 3 minutes for your machine to boot!
```
## 1. What is the name of the cookie used for authentication?
Huntress
Ten Years of Resilience, Innovation & Community-Driven Defense
blogs_huntress·2025-08-25·CVSS 8.8
[HIGH] Ten Years of Resilience, Innovation & Community-Driven Defense
The world of cybersecurity has been a wild ride over the last decade. As attackers stepped up their game year over year, the security community responded and adapted with resilience and ingenuity to each new wave of threats.
Attackers tested our limits time and time again with bolder, more cutting-edge cyberattacks: ransomware, supply chain compromises, zero-day vulnerabilities, and more. But every single breach, compromise, and exploited vulnerability taught us something new, pushed us harder to innovate and stay steps ahead, brought our security community closer together, and rallied us to wreck hackers.
As we celebrate our 10th anniversary at Huntress this month, we’re pausing to look back at the events that have shaped the entire cybersecurity community. Understanding where we've bee
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Tenable
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
blogs_tenable·2024-10-22
From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
Cybersecurity's Defining Moments | 7 Lessons from History's Most Infamous Breaches
blogs_sentinelone·2024-01-09
Cybersecurity's Defining Moments | 7 Lessons from History's Most Infamous Breaches
For CISOs and other experienced security leaders, understanding past incidents is crucial for preparing against future cyber threats. Delving into some of the most impactful cyberattacks in recent history can serve as a potent reminder of the diverse nature of cyber threats and the need for robust security measures.
In this post, we explore seven pivotal cybersecurity incidents, their impacts, and the invaluable lessons they offer to security leaders and organizations in fortifying their cyber defenses.
## 1 – Colonial Pipeline Ransomware Attack (2021)
The Colonial Pipeline ransomware attack in May 2021 stands as a stark moment that shows the very tangible impacts that cyber threats have on critical infrastructure. This incident not only disrupted digital operations but also had far-rea
Sentinelone
Cybersecurity's Defining Moments | 7 Lessons from History's Most Infamous Breaches
blogs_sentinelone·2024-01-09
Cybersecurity's Defining Moments | 7 Lessons from History's Most Infamous Breaches
For CISOs and other experienced security leaders, understanding past incidents is crucial for preparing against future cyber threats. Delving into some of the most impactful cyberattacks in recent history can serve as a potent reminder of the diverse nature of cyber threats and the need for robust security measures.
In this post, we explore seven pivotal cybersecurity incidents, their impacts, and the invaluable lessons they offer to security leaders and organizations in fortifying their cyber defenses .
## 1 – Colonial Pipeline Ransomware Attack (2021)
The Colonial Pipeline ransomware attack in May 2021 stands as a stark moment that shows the very tangible impacts that cyber threats have on critical infrastructure. This incident not only disrupted digital operations but also had far-re
Dfir Report
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
blogs_dfir_report·2023-12-18
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor’s Activity
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion Read More
- dragonforce Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs Read More
Services Overview
Threat Hunting
-
Integration
CTI Program Advisory
Incident Response Playbook
About us
Contact Us
Collaboration
Careers
Analysts
Access DFIR Labs
Get in Touch
Public Reports
Products Overview
Threat intel Overview
Threat Feed
Private DFIR Reports
All Intel
Active Defense
DFIR Labs
Case Artifacts
Detection Pack
AI Training Ground
Service Overview
Threat Hunting
Integration
CTI Program Advisory
Incident Response Playbook
Company Overview
About us
Contact Us
Careers
Analyst
SQL Brute Force Leads to BlueSky Ransomware
From OneNote to RansomNote: An Ice Col
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Sfruttamento vulnerabilità
## Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri Dec 15, 2023 Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerability
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Exploits & Vulnerabilities
# Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri
2023/12/15
Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerability at
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Exploits & Vulnerabilities
## Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri Dec 15, 2023 Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerability
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Exploits & Vulnerabilities
## Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri 2023/12/15 Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerability at
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Ausnutzung von Schwachstellen
## Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri Dec 15, 2023 Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerabili
Trendmicro
Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
blogs_trendmicro·2023-12-15·CVSS 9.8
CVE-2023-50164 [CRITICAL] Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
Exploits y vulnerabilidades
## Decoding CVE-2023-50164: Unveiling the Apache Struts File Upload Exploit
In this blog entry, we discuss the technical details of CVE-2023-50164, a critical vulnerability that affects Apache Struts 2 and enables unauthorized path traversal.
By: Jagir Shastri Dec 15, 2023 Read time: ( words)
Save to Folio
Apache has recently released an advisory regarding CVE-2023-50164, a critical vulnerability with a severity rating of 9.8 that affects Apache Struts 2. CVE-2023-50164 is intricately tied to an organization's Apache Struts architecture and the way it uses its file upload feature, enabling unauthorized path traversal that could be abused to upload a malicious file and perform remote code execution (RCE). It should be noted that exploiting this vulnerability
Securelist
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
blogs_securelist·2023-12-14
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
Table of Contents
- A new kind of network
- A not-so-new attack vector
- A new multiplatform implant
- A new communication
- A new backdoor with RAT capabilities
- A new threat
- Indicators of compromise
Authors
- Kaspersky GERT
- GReAT
During an incident response performed by Kaspersky’s Global Emergency Response Team (GERT) and GReAT, we uncovered a novel multiplatform threat named “NKAbuse”. The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities. Written in Go, it is flexible enough to generate binaries compatible with various architectures.
Our analysis suggests that the primary target of NKAbuse is Linux desktops. However, in view of its ability to infect MIPS and ARM systems,
Securelist
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
blogs_securelist·2023-12-14
Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol
Table of Contents
A new kind of network
A not-so-new attack vector
A new multiplatform implant
A new communication
A new backdoor with RAT capabilities
A new threat
Indicators of compromise
Authors
Kaspersky GERT
GReAT
During an incident response performed by Kaspersky’s Global Emergency Response Team ( GERT ) and GReAT, we uncovered a novel multiplatform threat named “NKAbuse”. The malware utilizes NKN technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities. Written in Go, it is flexible enough to generate binaries compatible with various architectures.
Our analysis suggests that the primary target of NKAbuse is Linux desktops. However, in view of its ability to infect MIPS and ARM systems, it also p
Bleepingcomputer
New NKAbuse malware abuses NKN blockchain for stealthy comms
blogs_bleepingcomputer·2023-12-14·CVSS 9.8
[CRITICAL] New NKAbuse malware abuses NKN blockchain for stealthy comms
## New NKAbuse malware abuses NKN blockchain for stealthy comms
## Bill Toulas
A new Go-based multi-platform malware identified as 'NKAbuse' is the first malware abusing NKN (New Kind of Network) technology for data exchange, making it a stealthy threat.
NKN is a relatively new decentralized peer-to-peer network protocol leveraging blockchain technology to manage resources and maintain a secure and transparent model for network operations.
One of the goals of NKN is to optimize data transmission speed and latency across the network, which is achievable by calculating efficient data packet travel paths.
Individuals can participate in the NKN network by running nodes, similar to the Tor network, and currently, there are approximately 60,710 nodes in it.
This relatively large number of
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Unit42
File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
blogs_unit42·2021-05-05
File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
Threat Research Center
Threat Research
Cloud Cybersecurity Research
## File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
Saeed Abbasi
Published: May 5, 2021
Cloud Cybersecurity Research
Threat Research
App-ID
File transfer
Insider threats
## Executive Summary
File transfers (i.e., upload and download) are vital for organizations and their employees’ productivity. For example, file uploads are essential for expense management platforms, content management systems (CMS), instant messaging and collaboration applications and services. Employees frequently transfer files to teammates, customers and partners, and it’s typically believed that the entire transferring process is safe. However, since the COVID-19 pandemic caused employees to transition t
Unit42
File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
blogs_unit42·2021-05-05
File Transfer Threats: Risk Factors and How Network Traffic Visibility Can Help
## Executive Summary
File transfers (i.e., upload and download) are vital for organizations and their employees’ productivity. For example, file uploads are essential for expense management platforms, content management systems (CMS), instant messaging and collaboration applications and services. Employees frequently transfer files to teammates, customers and partners, and it’s typically believed that the entire transferring process is safe. However, since the COVID-19 pandemic caused employees to transition to remote workspaces, it has become critical to reduce attack vectors for malicious actors by applying precise measures to guarantee an organization’s security for file transfers.
Cyberthreats involving malware begin with delivering specific malicious code to the victims. Generally,
Trendmicro
Bedrohungen und Risiken für Linux-Umgebungen, Teil 1
blogs_trendmicro·2021-02-02
Bedrohungen und Risiken für Linux-Umgebungen, Teil 1
Cyberbedrohungen
## Bedrohungen und Risiken für Linux-Umgebungen, Teil 1
Cyberkriminelle richten ihre Aufmerksamkeit und Ressourcen auf Linux-Zielumgebungen mit ihren entsprechenden Schwachpunkten. Welches sind die größten Risiken für diese Plattformen?
By: Magno Logan Feb 02, 2021 Read time: ( words)
Save to Folio
Originalartikel von Magno Logan, Pawan Kinger
Linux ist heute eines der mächtigsten Betriebssysteme, das auf Cloud-Plattformen und Servern weltweit vorherrschend ist. Tatsächlich hat die Nutzung von Linux die von Windows auf Azure, Microsofts eigener Cloud-Plattform, inzwischen übertroffen. Dem 2017 State of Linux Kernel Development Report der Linux Foundation zufolge liefen 90% der öffentlichen Cloud Workloads unter Linux und neun der zehn Top- Public Cloud Provider setze
Tenable
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
blogs_tenable·2021-01-21
Daisy Chaining: How Vulnerabilities Can Be Greater Than the Sum of Their Parts
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
blogs_trendmicro·2020-09-08
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
Cloud
## Exposed Docker Server Abused to Drop Cryptominer, DDoS Bot
Malicious actors continue to target environments running Docker containers. We recently encountered an attack that drops both a malicious cryptocurrency miner and a DDoS bot on a Docker container built using Alpine Linux as its base image.
By: Augusto Remillano II Sep 08, 2020 Read time: ( words)
Save to Folio
Malicious actors continue to target environments running Docker containers . We recently encountered an attack that drops both a malicious cryptocurrency miner and a distributed denial-of-service (DDoS) bot on a Docker container built using Alpine Linux as its base image. A similar attack was also reported by Trend Micro in May; in that previous attack, threat actors created a malicious Alpine Linux container to
Trendmicro
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
blogs_trendmicro·2020-09-08
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
Nube
## Exposed Docker Server Abused to Drop Cryptominer, DDoS Bot
Malicious actors continue to target environments running Docker containers. We recently encountered an attack that drops both a malicious cryptocurrency miner and a DDoS bot on a Docker container built using Alpine Linux as its base image.
By: Augusto Remillano II Sep 08, 2020 Read time: ( words)
Save to Folio
Malicious actors continue to target environments running Docker containers . We recently encountered an attack that drops both a malicious cryptocurrency miner and a distributed denial-of-service (DDoS) bot on a Docker container built using Alpine Linux as its base image. A similar attack was also reported by Trend Micro in May; in that previous attack, threat actors created a malicious Alpine Linux container to
Trendmicro
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
blogs_trendmicro·2020-09-08
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
Cloud
## Exposed Docker Server Abused to Drop Cryptominer, DDoS Bot
Malicious actors continue to target environments running Docker containers. We recently encountered an attack that drops both a malicious cryptocurrency miner and a DDoS bot on a Docker container built using Alpine Linux as its base image.
By: Augusto Remillano II 2020/09/08 Read time: ( words)
Save to Folio
Malicious actors continue to target environments running Docker containers . We recently encountered an attack that drops both a malicious cryptocurrency miner and a distributed denial-of-service (DDoS) bot on a Docker container built using Alpine Linux as its base image. A similar attack was also reported by Trend Micro in May; in that previous attack, threat actors created a malicious Alpine Linux container to a
Trendmicro
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
blogs_trendmicro·2020-09-08
Exposed Docker Server Abused to Drop Cryptominer DDoS Bot
Cloud
# Exposed Docker Server Abused to Drop Cryptominer, DDoS Bot
Malicious actors continue to target environments running Docker containers. We recently encountered an attack that drops both a malicious cryptocurrency miner and a DDoS bot on a Docker container built using Alpine Linux as its base image.
By: Augusto Remillano II
2020/09/08
Read time: ( words)
Save to Folio
Malicious actors continue to target environments running Docker containers. We recently encountered an attack that drops both a malicious cryptocurrency miner and a distributed denial-of-service (DDoS) bot on a Docker container built using Alpine Linux as its base image. A similar attack was also reported by Trend Micro in May; in that previous attack, threat actors created a malicious Alpine Linux container to al
Unit42
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
blogs_unit42·2020-08-26
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
Threat Research Center
Threat Research
Vulnerabilities
## The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
Jay Chen
Published: August 26, 2020
Threat Research
Vulnerabilities
Exploit
## Executive Summary
With the ever-increasing number of new vulnerabilities, vulnerability management becomes one of the most critical processes in ensuring continuous business operation. While it is clear that timely patching is essential, it’s also important to know quantitatively how a delay could increase risk. What is the chance that attackers breach my organization using a CVE just disclosed or using an unknown (zero-day) vulnerability? To understand the state of vulnerability disclosure and exploit development, Unit 42 researchers analyzed 45,450 publicly availabl
Unit42
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
blogs_unit42·2020-08-26
The State of Exploit Development: 80% of Exploits Publish Faster than CVEs
## Executive Summary
With the ever-increasing number of new vulnerabilities, vulnerability management becomes one of the most critical processes in ensuring continuous business operation. While it is clear that timely patching is essential, it’s also important to know quantitatively how a delay could increase risk. What is the chance that attackers breach my organization using a CVE just disclosed or using an unknown (zero-day) vulnerability? To understand the state of vulnerability disclosure and exploit development, Unit 42 researchers analyzed 45,450 publicly available exploits in Exploit Database at the time of this writing. The research correlated the exploit data with vulnerability and patch information to study exploit development in multiple facets.
The research reveals that:
-
Tenable
CVE-2019-0230: Apache Struts Potential Remote Code Execution Vulnerability
blogs_tenable·2020-08-14·CVSS 9.8
[CRITICAL] CVE-2019-0230: Apache Struts Potential Remote Code Execution Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
Qualys
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
blogs_qualys·2019-12-27·CVSS 8.8
[HIGH] Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking | Qualys
A recent report identified 19+ vulnerabilities that should be mitigated by end of year 2019. These are a range of top vulnerabilities attacked and leveraged by Advance Persistent Threat (APT) actors from all parts of the world.
The list below shows those top 19 vulnerabilities, and it should be no surprise that you can easily track and remediate them via a dashboard within Qualys. Import the dashboard into your subscription for easy insight into what assets and vulnerabilities in your organization are at risk.
No.
CVE
Products Affected by CVE
CVSS Score (NVD)
Examples of Threat Actors
1
CVE-2017-11882
Microsoft Office
7.8
APT32 (Vietnam), APT34 (Iran), APT40 (China), APT-C-35 (India), Cobalt Group (Spain, Ukraine), Silent Group (Russia), Lotus Blossom (China), FIN7 (Russia)
2
CVE-2018-
Zscaler
A look at the recent BuleHero botnet payload | Zscaler
blogs_zscaler·2019-12-12
A look at the recent BuleHero botnet payload | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
blogs_talos·2019-09-17·CVSS 7.5
[HIGH] Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
By Christopher Evans and David Liebenberg.
## Executive summary A new threat actor named "Panda" has generated thousands of dollars worth of the Monero cryptocurrency through the use of remote access tools (RATs) and illicit cryptocurrency-mining malware. This is far from the most sophisticated actor we've ever seen, but it still has been one of the most active attackers we've seen in Cisco Talos threat trap data. Panda's willingness to persistently exploit vulnerable web applications worldwide, their tools allowing them to traverse throughout networks, and their use of RATs, means that organizations worldwide are at risk of having their system resources misused for mining purposes or worse, such as exfiltration of valuable information.
Panda has shown time and again they will update the
Talos
Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
blogs_talos·2019-09-17
Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
## Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
By Christopher Evans and David Liebenberg .
## Executive summary A new threat actor named "Panda" has generated thousands of dollars worth of the Monero cryptocurrency through the use of remote access tools (RATs) and illicit cryptocurrency-mining malware. This is far from the most sophisticated actor we've ever seen, but it still has been one of the most active attackers we've seen in Cisco Talos threat trap data. Panda's willingness to persistently exploit vulnerable web applications worldwide, their tools allowing them to traverse throughout networks, and their use of RATs, means that organizations worldwide are at risk of having their system resources misused for mining purposes or worse, such as e
Trendmicro
Multistage Attack Delivers BillGates/Setag Backdoor
blogs_trendmicro·2019-07-23
Multistage Attack Delivers BillGates/Setag Backdoor
Malware
# Multistage Attack Delivers BillGates/Setag Backdoor
Elasticsearch is no stranger to cybercriminal abuse given its popularity. This year’s first quarter saw a surge of attacks — whether by exploiting vulnerabilities or taking advantage of security gaps — leveled against Elasticsearch servers.
By: Jindrich Karasek, Augusto Remillano II, Tony Bao
2019/07/23
Read time: ( words)
Save to Folio
Elasticsearch is no stranger to cybercriminal abuse given its popularity and use to organizations. In fact, this year’s first quarter saw a surge of attacks — whether by exploiting vulnerabilities or taking advantage of security gaps — leveled against Elasticsearch servers. These attacks mostly delivered cryptocurrency-mining malware, as in the case of one attack we saw last year.
The late
Trendmicro
Multistage Attack Delivers BillGates/Setag Backdoor
blogs_trendmicro·2019-07-23
Multistage Attack Delivers BillGates/Setag Backdoor
Malware
# Multistage Attack Delivers BillGates/Setag Backdoor
Elasticsearch is no stranger to cybercriminal abuse given its popularity. This year’s first quarter saw a surge of attacks — whether by exploiting vulnerabilities or taking advantage of security gaps — leveled against Elasticsearch servers.
By: Jindrich Karasek, Augusto Remillano II, Tony Bao
Jul 23, 2019
Read time: ( words)
Save to Folio
Elasticsearch is no stranger to cybercriminal abuse given its popularity and use to organizations. In fact, this year’s first quarter saw a surge of attacks — whether by exploiting vulnerabilities or taking advantage of security gaps — leveled against Elasticsearch servers. These attacks mostly delivered cryptocurrency-mining malware, as in the case of one attack we saw last year.
The la
Talos
2018 in Snort Rules
blogs_talos·2019-02-06
2018 in Snort Rules
This blog post was authored by Benny Ketelslegers of Cisco Talos
The cybersecurity field shifted quite a bit in 2018. With the boom of cryptocurrency, we saw a transition from ransomware to cryptocurrency miners. Talos researchers identified APT campaigns including VPNFilter, predominantly affecting small business and home office networking equipment, as well as Olympic Destroyer, apparently designed to disrupt the Winter Olympics.
But these headline-generating attacks were only a small part of the day-to-day protection provided by security systems. In this post, we'll review some of the findings created by investigating the most frequently triggered SNORTⓇ rules as reported by Cisco Meraki systems. These rules protected our customers from some of the most common attacks that, even though
Unit42
Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
blogs_unit42·2018-09-10·CVSS 9.8
CVE-2017-5638 [CRITICAL] Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
Threat Research Center
Threat Research
Malware
## Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
Ruchna Nigam
Published: September 9, 2018
Malware
Threat Research
Vulnerabilities
Apache Struts
BlackNurse
Botnet
CVE-2017-5638
CVE-2018-9866
Exploits
Gafgyt
IoT
Linux
Mirai
SonicWall RCE
Executive Summary:
Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since.
These variants are notable for two reasons:
The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017.
The new Gafgyt version targets a newly disclosed vulnerability affectin
Unit42
Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
blogs_unit42·2018-09-10·CVSS 9.8
[CRITICAL] Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall
Executive Summary:
Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since.
These variants are notable for two reasons:
- The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017.
- The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).
These developments suggest these IOT botnets are increasingly targeting enterprise devices with outdated versions.
All organizations should ensure they keep not only their systems up-to-date and patched, but also their IoT devices. For Palo Alto Networks cust
Tenable
New Apache Struts Vulnerability Could Allow for Remote Code Execution
blogs_tenable·2018-08-22
New Apache Struts Vulnerability Could Allow for Remote Code Execution
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
New Apache Struts Vulnerability Could Allow for Remote Code Execution
blogs_tenable·2018-08-22·CVSS 9.8
[CRITICAL] New Apache Struts Vulnerability Could Allow for Remote Code Execution
Blog / Cyber Exposure Alerts
Subscribe
# New Apache Struts Vulnerability Could Allow for Remote Code Execution
Ryan Seguin
August 22, 2018
5 Min Read
Updated August 23: A working proof of concept (PoC) has been discovered and verified on Github by Tenable’s research team. In addition, there are indications that attackers are already probing for vulnerable Apache Struts instances.
## Background
Semmle researchers discovered and disclosed a remote code execution (RCE) vulnerability (CVE-2018-11776) in servers running Apache Struts that meet specific configuration requirements. According to Semmle, those requirements are:
- The alwaysSelectFullNamespace flag is set to true in the Struts configuration. (Note: this is automatically the case if your application uses the popular Struts Co
Qualys
Vulnerability Management Prioritization | How to Prioritize Threats | Qualys
blogs_qualys·2018-05-07·CVSS 9.8
[CRITICAL] Vulnerability Management Prioritization | How to Prioritize Threats | Qualys
#### Table of Contents
- Vulnerability management and prioritization tips
- Qualys: Asset visibility, vulnerability management and threat prioritization
Here’s a stat that shows the importance of prioritizing vulnerability remediation: Almost 30% of the CVEs disclosed in 2017 had a CVSS score of “High” or “Critical.” That works out to about 3,000 such vulnerabilities, or about 58 every week.
Given this large number of severe vulnerabilities, it’s critical for IT and security teams to make a deeper assessment of the risk they represent in the context of their organizations’ IT environment.
If they identify the vulnerabilities that pose the highest risk to their organization’s most critical assets, they’ll be able to prioritize remediation accordingly and eliminate the most serious and p
Qualys
How To Prioritize Vulnerabilities in a Modern IT Environment
blogs_qualys·2018-05-07·CVSS 9.8
[CRITICAL] How To Prioritize Vulnerabilities in a Modern IT Environment
## Table of Contents
Vulnerability management and prioritization tips
Qualys: Asset visibility, vulnerability management and threat prioritization
Here’s a stat that shows the importance of prioritizing vulnerability remediation: Almost 30% of the CVEs disclosed in 2017 had a CVSS score of “High” or “Critical.” That works out to about 3,000 such vulnerabilities, or about 58 every week.
Given this large number of severe vulnerabilities, it’s critical for IT and security teams to make a deeper assessment of the risk they represent in the context of their organizations’ IT environment.
If they identify the vulnerabilities that pose the highest risk to their organization’s most critical assets, they’ll be able to prioritize remediation accordingly and eliminate the most serious and pressi
Qualys
Cryptomining is all the rage among hackers, as DDoS amplification attacks continue
blogs_qualys·2018-03-09
Cryptomining is all the rage among hackers, as DDoS amplification attacks continue
In this week’s InfoSec news review we’ll dive into cryptomining, get the latest on DDoS amplification, go over recent data breaches, and check out another vendor claiming it can crack iPhones.
## I, me, mine
The freight train that’s cryptomining shows no sign of slowing down, and the cyber security implications are intensifying accordingly.
This week alone, Microsoft detected and disrupted a massive cryptomining malware campaign, a Tesla AWS account got hijacked , a new mining worm was discovered , and Kaspersky researchers warned about increased sophistication of infection methods .
While there is a legitimate component to this business, malicious hackers eager to profit are aggressively breaching networks and infecting devices — PCs, IoT systems, smartphones, servers — to steal compu
Qualys
Cryptomining is all the rage among hackers, as DDoS amplification attacks continue | Qualys
blogs_qualys·2018-03-09
Cryptomining is all the rage among hackers, as DDoS amplification attacks continue | Qualys
In this week’s InfoSec news review we’ll dive into cryptomining, get the latest on DDoS amplification, go over recent data breaches, and check out another vendor claiming it can crack iPhones.
### I, me, mine
The freight train that’s cryptomining shows no sign of slowing down, and the cyber security implications are intensifying accordingly.
This week alone, Microsoft detected and disrupted a massive cryptomining malware campaign, a Tesla AWS account got hijacked, a new mining worm was discovered, and Kaspersky researchers warned about increased sophistication of infection methods.
While there is a legitimate component to this business, malicious hackers eager to profit are aggressively breaching networks and infecting devices — PCs, IoT systems, smartphones, servers — to steal computi
Talos
2017 in Snort Rules
blogs_talos·2018-01-29
2017 in Snort Rules
This post was written by Martin Lee and Vanja Svajcer.
2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact organizations throughout the world. In 2017, Talos researchers discovered many new attacks including backdoors in legitimate software such as CCleaner, designed to target high tech companies as well as M.E.Doc, responsible for initial spread of Nyetya. Despite all those, headline making attacks are only a small part of the day to day protection provided by security systems.
In this post we review some of the findings created by investigating the most frequently triggered Snort rules as reported by Cisco Meraki systems and included in the Snort default policy set.
## Top 5
Talos
2017 in Snort Rules
blogs_talos·2018-01-29
2017 in Snort Rules
## 2017 in Snort Rules
This post was written by Martin Lee and Vanja Svajcer .
2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact organizations throughout the world. In 2017, Talos researchers discovered many new attacks including backdoors in legitimate software such as CCleaner , designed to target high tech companies as well as M.E.Doc , responsible for initial spread of Nyetya . Despite all those, headline making attacks are only a small part of the day to day protection provided by security systems.
In this post we review some of the findings created by investigating the most frequently triggered Snort rules as reported by Cisco Meraki systems and included in the Snort de
Trendmicro
Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
blogs_trendmicro·2018-01-19·CVSS 9.8
[CRITICAL] Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
Exploits & Vulnerabilities
## Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
By: Hubert Lin 2018/01/19 Read time: ( words)
Save to Folio
Threat actors have turned to cryptocurrency mining as a reliable way to make a profit in recent months. Cryptocurrency miners use the computing power of end user systems to mine coins of various kinds, most commonly via malware or compromised websites. By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
In recent weeks we have noted a signific
Trendmicro
Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
blogs_trendmicro·2018-01-19·CVSS 9.8
[CRITICAL] Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
Exploits y vulnerabilidades
## Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
By: Hubert Lin Jan 19, 2018 Read time: ( words)
Save to Folio
Threat actors have turned to cryptocurrency mining as a reliable way to make a profit in recent months. Cryptocurrency miners use the computing power of end user systems to mine coins of various kinds, most commonly via malware or compromised websites. By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
In recent weeks we have noted a signi
Trendmicro
Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
blogs_trendmicro·2018-01-19·CVSS 9.8
[CRITICAL] Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
Exploits & Vulnerabilities
## Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
By: Hubert Lin Jan 19, 2018 Read time: ( words)
Save to Folio
Threat actors have turned to cryptocurrency mining as a reliable way to make a profit in recent months. Cryptocurrency miners use the computing power of end user systems to mine coins of various kinds, most commonly via malware or compromised websites. By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
In recent weeks we have noted a signif
Trendmicro
Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
blogs_trendmicro·2018-01-19·CVSS 9.8
[CRITICAL] Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
Exploits & Vulnerabilities
# Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
By: Hubert Lin
2018/01/19
Read time: ( words)
Save to Folio
Threat actors have turned to cryptocurrency mining as a reliable way to make a profit in recent months. Cryptocurrency miners use the computing power of end user systems to mine coins of various kinds, most commonly via malware or compromised websites. By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
In recent weeks we have noted a signific
Trendmicro
Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
blogs_trendmicro·2018-01-19·CVSS 9.8
[CRITICAL] Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
Ausnutzung von Schwachstellen
## Struts and DotNetNuke Server Exploits Used For Cryptocurrency Mining
By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
By: Hubert Lin Jan 19, 2018 Read time: ( words)
Save to Folio
Threat actors have turned to cryptocurrency mining as a reliable way to make a profit in recent months. Cryptocurrency miners use the computing power of end user systems to mine coins of various kinds, most commonly via malware or compromised websites. By compromising servers in order to run cryptocurrency miners, the threat actors would gain access to more computing power and increase their profits from illicit mining.
In recent weeks we have noted a sig
Tenable
CDM: Making US Federal Agencies More AWARE of Cyber Exposure
blogs_tenable·2018-01-16
CDM: Making US Federal Agencies More AWARE of Cyber Exposure
Blog / News and Views
Subscribe
# CDM: Making US Federal Agencies More AWARE of Cyber Exposure
Chris Jensen
January 16, 2018
4 Min Read
At a recent Tenable sponsored MeriTalk event, Kevin Cox, program manager for Continuous Diagnostics and Mitigation (CDM), provided a preview of coming attractions regarding the CDM federal dashboard. As of this writing, the CDM dashboard is in its initial production stage, with agency exchanges being set up to aggregate the data to be fed into the dashboard. At least five agencies are reportedly on track to have data uploaded to the CDM dashboard during the first quarter of 2018.
### Agency-Wide Adaptive Risk Enumeration (AWARE): New scoring algorithm for cyber hygiene
Looking ahead, Cox announced that Release 5 of the CDM dashboard, due out in the
Tenable
CDM: Making US Federal Agencies More AWARE of Cyber Exposure
blogs_tenable·2018-01-16
CDM: Making US Federal Agencies More AWARE of Cyber Exposure
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop
blogs_krebs·2017-09-19
Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop
Visa and MasterCard are sending confidential alerts to financial institutions across the United States this week, warning them about more than 200,000 credit cards that were stolen in the epic data breach announced last week at big-three credit bureau Equifax. At first glance, the private notices obtained by KrebsOnSecurity appear to suggest that hackers initially breached Equifax starting in November 2016. But Equifax says the accounts were all stolen at the same time — when hackers accessed the company’s systems in mid-May 2017.
Both Visa and MasterCard frequently send alerts to card-issuing financial institutions with information about specific credit and debit cards that may have been compromised in a recent breach. But it is unusual for these alerts to state from which company the ac
Talos
Another Apache Struts Vulnerability Under Active Exploitation
blogs_talos·2017-09-07·CVSS 9.8
CVE-2017-9805 [CRITICAL] Another Apache Struts Vulnerability Under Active Exploitation
This post authored by Nick Biasini with contributions from Alex Chiu.
Earlier this week, a critical vulnerability in Apache Struts was publicly disclosed in a security advisory. This new vulnerability, identified as CVE-2017-9805, manifests due to the way the REST plugin uses XStreamHandler with an instance of XStream for deserialization without any type filtering. As a result, a remote, unauthenticated attacker could achieve remote code execution on a host running a vulnerable version of Apache Struts.
This isn't the only vulnerability that has been recently identified in Apache Struts. Earlier this year, Talos responded to a zero-day vulnerability that was under active exploitation in the wild. Talos has observed exploitation activity targeting CVE-2017-9805 in a way that is similar to
Talos
Another Apache Struts Vulnerability Under Active Exploitation
blogs_talos·2017-09-07·CVSS 9.8
CVE-2017-9805 [CRITICAL] Another Apache Struts Vulnerability Under Active Exploitation
## Another Apache Struts Vulnerability Under Active Exploitation
This post authored by Nick Biasini with contributions from Alex Chiu .
Earlier this week, a critical vulnerability in Apache Struts was publicly disclosed in a security advisory. This new vulnerability, identified as CVE-2017-9805, manifests due to the way the REST plugin uses XStreamHandler with an instance of XStream for deserialization without any type filtering. As a result, a remote, unauthenticated attacker could achieve remote code execution on a host running a vulnerable version of Apache Struts.
This isn't the only vulnerability that has been recently identified in Apache Struts. Earlier this year , Talos responded to a zero-day vulnerability that was under active exploitation in the wild. Talos has observed explo
Tenable
Apache Struts REST Plugin XStream XML Request Deserialization RCE (CVE 2017-9805)
blogs_tenable·2017-09-06
Apache Struts REST Plugin XStream XML Request Deserialization RCE (CVE 2017-9805)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Apache Struts REST Plugin XStream XML Request Deserialization RCE (CVE 2017-9805)
blogs_tenable·2017-09-06
CVE-2017-9805 Apache Struts REST Plugin XStream XML Request Deserialization RCE (CVE 2017-9805)
Blog /
Subscribe
# Apache Struts REST Plugin XStream XML Request Deserialization RCE (CVE 2017-9805)
Scott Caveza
September 6, 2017
3 Min Read
A new critical vulnerability (S2-052) in the Apache Struts framework (CVE 2017-9805) could allow an unauthenticated attacker to run arbitrary commands on a server using the Struts framework with the popular REST communication plugin.
### Vulnerability details
A remote code execution vulnerability exists in Apache Struts due to an unsafe deserialization of Java code in the REST plugin. The REST plugin uses XStream to deserialize XML requests without first sanitizing user-supplied input. This allows a remote unauthenticated attacker to execute arbitrary code using a crafted XML payload passed to the REST plugin.
A code sample used by lgtm to i
Krebs
Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop – Krebs on Security
blogs_krebs·2017-09-01
Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop – Krebs on Security
Visa and MasterCard are sending confidential alerts to financial institutions across the United States this week, warning them about more than 200,000 credit cards that were stolen in the epic data breach announced last week at big-three credit bureau Equifax . At first glance, the private notices obtained by KrebsOnSecurity appear to suggest that hackers initially breached Equifax starting in November 2016. But Equifax says the accounts were all stolen at the same time — when hackers accessed the company’s systems in mid-May 2017.
Both Visa and MasterCard frequently send alerts to card-issuing financial institutions with information about specific credit and debit cards that may have been compromised in a recent breach. But it is unusual for these alerts to state from which company the a
Trendmicro
Cerber Version 6 Shows How Far the Ransomware Has Come
blogs_trendmicro·2017-05-02
Cerber Version 6 Shows How Far the Ransomware Has Come
# Cerber Version 6 Shows How Far the Ransomware Has Come
A reflection of how far Cerber has come in the threat landscape—and how far it’ll go—is Cerber Version 6. The ransomware’s latest version sports multipart arrival vectors, refashioned file encryption routines, and defense mechanisms
By: Gilbert Sison, Alfredo Oliveira
2017/05/02
Read time: ( words)
Save to Folio
A little over a year after its first variants were found in the wild, Cerber (Detected by Trend Micro as RANSOM_CERBER family) now has the reputation for being the most prolific family of ransomware in the threat landscape. Since it first emerged in Russian underground marketplaces in March, 2016, Cerber has since spawned several versions whose structure, techniques, and capabilities were regularly updated by its develop
Tenable
Hunting Linux Malware with YARA
blogs_tenable·2017-04-10·CVSS 9.8
[CRITICAL] Hunting Linux Malware with YARA
Blog / Research
Subscribe
# Hunting Linux Malware with YARA
Jacob Baines
April 10, 2017
4 Min Read
Tenable recently released two new YARA plugins to complement the already existing Windows YARA plugin. The new plugins are YARA Memory Scan (Linux) and YARA File Scan (Linux) (Solaris). The plugins bring YARA functionality to Linux and Solaris hosts. This blog discusses a couple of scenarios in which these plugins are useful.
### Memory scanning
There’s been a lot of chatter about the recent Struts 2 remote code execution vulnerability CVE-2017-5638. Much of the excitement is due to the active exploitation of the vulnerability in the wild. In response, we’ve published a blog explaining how to use Nessus to detect the vulnerability.
There are many approaches that should be taken to det
Tenable
Hunting Linux Malware with YARA
blogs_tenable·2017-04-10
Hunting Linux Malware with YARA
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
A Comprehensive Approach to Detect and Block the Struts Critical Vulnerability CVE-2017-5638
blogs_qualys·2017-03-14·CVSS 9.8
[CRITICAL] A Comprehensive Approach to Detect and Block the Struts Critical Vulnerability CVE-2017-5638
With hackers taking advantage of the Apache Struts vulnerability and aggressively attacking enterprises worldwide, Qualys can protect your organization from this critical bug, which is hard to detect and difficult to patch.
Recently disclosed, the Struts vulnerability is being actively attacked in the wild , as hackers jump at the chance to hit high-profile targets by exploiting this critical bug . Struts, an Apache open source framework for creating “enterprise-ready” Java web applications , is abundantly present in large Internet companies, government agencies and financial institutions.
For an informative walkthrough of the vulnerability and the Qualys detections, please view the Detect and Block Apache Struts Bug webcast recording.
## The Lowdown on the Vulnerability
In its emergen
Tenable
Apache Struts Jakarta Remote Code Execution (CVE-2017-5638) Detection with Nessus
blogs_tenable·2017-03-14·CVSS 9.8
CVE-2017-5638 [CRITICAL] Apache Struts Jakarta Remote Code Execution (CVE-2017-5638) Detection with Nessus
Blog /
Subscribe
# Apache Struts Jakarta Remote Code Execution (CVE-2017-5638) Detection with Nessus
Lucas Tamagna-Darr
March 14, 2017
2 Min Read
A remote code execution vulnerability (CVE-2017-5638) in the Jakarta Multipart Parser in certain versions of the Apache Struts framework can enable a remote attacker to run arbitrary commands on the web server. Since its initial disclosure, this vulnerability has received significant attention, and is reportedly exploited in the wild. Public exploits are also available for this vulnerability. Customers are advised to immediately patch their servers to the latest versions of Apache Struts or implement recommended workarounds.
### Vulnerability details
A remote code execution vulnerability exists due to a weakness in the way that the Jakarta
Tenable
Apache Struts Jakarta Remote Code Execution (CVE-2017-5638) Detection with Nessus
blogs_tenable·2017-03-14·CVSS 9.8
[CRITICAL] Apache Struts Jakarta Remote Code Execution (CVE-2017-5638) Detection with Nessus
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
CVE-2017-5638 Apache Struts Vulnerability | Qualys
blogs_qualys·2017-03-14·CVSS 9.8
CVE-2017-5638 [CRITICAL] CVE-2017-5638 Apache Struts Vulnerability | Qualys
With hackers taking advantage of the Apache Struts vulnerability and aggressively attacking enterprises worldwide, Qualys can protect your organization from this critical bug, which is hard to detect and difficult to patch.
Recently disclosed, the Struts vulnerability is being actively attacked in the wild, as hackers jump at the chance to hit high-profile targets by exploiting this critical bug. Struts, an Apache open source framework for creating “enterprise-ready” Java web applications, is abundantly present in large Internet companies, government agencies and financial institutions.
For an informative walkthrough of the vulnerability and the Qualys detections, please view the Detect and Block Apache Struts Bug webcast recording.
### The Lowdown on the Vulnerability
In its emergency
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
[CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Cyber Threats
## Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu 2017/03/09 Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed th
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
[CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Cyberbedrohungen
## Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu Mar 09, 2017 Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observ
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
CVE-2017-5638 [CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Cyber Threats
# Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu
2017/03/09
Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed th
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
[CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Ciberamenazas
## Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu Mar 09, 2017 Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
[CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Minacce cyber
## Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu Mar 09, 2017 Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed
Qualys
Qualys WAF 2.0 Protects Against Critical Apache Struts Jakarta Vulnerability ( CVE-2017-5638 ) | Qualys
blogs_qualys·2017-03-09·CVSS 9.8
CVE-2017-5638 [CRITICAL] Qualys WAF 2.0 Protects Against Critical Apache Struts Jakarta Vulnerability ( CVE-2017-5638 ) | Qualys
On March 8, 2017, Qualys published a detailed blog to describe a critical vulnerability in Apache Struts2 Jakarta multipart parser that exposes vulnerable applications to Remote Command Execution attacks. Exploits of this vulnerability can allow attackers to steal critical data or take control of your application servers.
Qualys Web Application Firewall (WAF) 2.0 allows you to create custom security rules to detect and block attacks that try to exploit this vulnerability.
Since this vulnerability is triggered by invalid values in the Content-Type header for multipart HTTP requests, a simple custom rule could use the following conditions:
request.path EQUAL “/struts2-showcase/index.action”
request.header “Content-Type” NOT.EQUAL “multipart/form-data”
The above custom rule will detect a
Trendmicro
Apache Struts 2 Vulnerability Leads to RCE
blogs_trendmicro·2017-03-09·CVSS 9.8
[CRITICAL] Apache Struts 2 Vulnerability Leads to RCE
Cyber Threats
## Apache Struts 2 Vulnerability Leads to RCE
We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed that in most of them, attackers have used Object Graph Navigation Language (OGNL) expressions.
By: Suraj Sahu Mar 09, 2017 Read time: ( words)
Save to Folio
Updated as of March 13, 2017, 8:06 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Security™.
Updated as of August 9, 2017, 10:42 PM, UTC-7: We updated the section on Trend Micro solutions, particularly on Deep Discovery Inspector.
Apache Struts is a free and open-source framework used to build Java web applications. We looked into past several Remote Code Execution (RCE) vulnerabilities reported in Apache Struts, and observed
Qualys
Qualys WAF 2.0 Protects Against Critical Apache Struts Jakarta Vulnerability ( CVE-2017-5638 )
blogs_qualys·2017-03-09·CVSS 9.8
[CRITICAL] Qualys WAF 2.0 Protects Against Critical Apache Struts Jakarta Vulnerability ( CVE-2017-5638 )
On March 8, 2017, Qualys published a detailed blog to describe a critical vulnerability in Apache Struts2 Jakarta multipart parser that exposes vulnerable applications to Remote Command Execution attacks. Exploits of this vulnerability can allow attackers to steal critical data or take control of your application servers.
Qualys Web Application Firewall (WAF) 2.0 allows you to create custom security rules to detect and block attacks that try to exploit this vulnerability.
Since this vulnerability is triggered by invalid values in the Content-Type header for multipart HTTP requests, a simple custom rule could use the following conditions:
request.path EQUAL “/struts2-showcase/index.action”
request.header “Content-Type” NOT.EQUAL “multipart/form-data”
The above custom rule will detect an
Talos
Content-Type: Malicious - New Apache Struts2 0-day Under Attack
blogs_talos·2017-03-08·CVSS 9.8
CVE-2017-5638 [CRITICAL] Content-Type: Malicious - New Apache Struts2 0-day Under Attack
UPDATE: It was recently disclosed that in addition to Content-Type being vulnerable, both Content-Disposition and Content-Length can be manipulated to trigger this particular vulnerability. No new CVE was listed, however details of the vulnerability and remediation are available in this security advisory.
Talos has observed a new Apache vulnerability that is being actively exploited in the wild. The vulnerability (CVE-2017-5638) is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, referenced in this security advisory. Talos began investigating for exploitation attempts and found a high number of exploitation events. The majority of the exploitation attempts seem to be leveraging a publicly released PoC that is being used to run various commands. Talos
Talos
Content-Type: Malicious - New Apache Struts2 0-day Under Attack
blogs_talos·2017-03-08·CVSS 9.8
[CRITICAL] Content-Type: Malicious - New Apache Struts2 0-day Under Attack
## Content-Type: Malicious - New Apache Struts2 0-day Under Attack
UPDATE: It was recently disclosed that in addition to Content-Type being vulnerable, both Content-Disposition and Content-Length can be manipulated to trigger this particular vulnerability. No new CVE was listed, however details of the vulnerability and remediation are available in this security advisory .
Talos has observed a new Apache vulnerability that is being actively exploited in the wild. The vulnerability (CVE-2017-5638) is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, referenced in this security advisory . Talos began investigating for exploitation attempts and found a high number of exploitation events. The majority of the exploitation attempts seem to be leveraging a p
Recorded Future
China vs. U.S.: The Race in Vulnerability Reporting | Recorded Future
blogs_recorded_future
China vs. U.S.: The Race in Vulnerability Reporting | Recorded Future
## The Dragon Is Winning: U.S. Lags Behind Chinese Vulnerability Reporting
Click here to download this article as a PDF .
## Key Takeaways
Organizations need access to the latest vulnerability (CVE) information to manage their exposure to risk.
The U.S. National Vulnerability Database (NVD) trails China’s National Vulnerability Database (CNNVD) in average time between initial disclosure and database inclusion (33 days versus 13 days) — China isn’t directly integrated in managing CVEs, but are still able to report vulnerabilities more rapidly than the U.S.
CNNVD actively gathers vulnerability information across the web. NVD should do this but instead waits for voluntary submission by vendors.
NVD’s mission should aim to be truly comprehensive, and the U.S. could improve by simply inco
Greynoiseio
Battling Ransomware One Tag At A Time
blogs_greynoiseio
Battling Ransomware One Tag At A Time
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
China vs. U.S.: The Race in Vulnerability Reporting
blogs_recorded_future
China vs. U.S.: The Race in Vulnerability Reporting
# The Dragon Is Winning: U.S. Lags Behind Chinese Vulnerability Reporting
Click here to download this article as a PDF.
### Key Takeaways
- Organizations need access to the latest vulnerability (CVE) information to manage their exposure to risk.
- The U.S. National Vulnerability Database (NVD) trails China’s National Vulnerability Database (CNNVD) in average time between initial disclosure and database inclusion (33 days versus 13 days) — China isn’t directly integrated in managing CVEs, but are still able to report vulnerabilities more rapidly than the U.S.
- CNNVD actively gathers vulnerability information across the web. NVD should do this but instead waits for voluntary submission by vendors.
- NVD’s mission should aim to be truly comprehensive, and the U.S. could improve by simply
Huntress
Equifax Data Breach: What Happened, Impact, and Lessons | Huntress
blogs_huntress·CVSS 9.8
[CRITICAL] Equifax Data Breach: What Happened, Impact, and Lessons | Huntress
## Equifax Data Breach
Published: 11/14/2025
Written by: Lizzie Danielson
The Equifax data breach is one of the most infamous cybersecurity incidents in recent history, exposing the personal data of millions of individuals and shaking public trust in the credit reporting giant. Discovered in 2017, this breach highlighted severe vulnerabilities and served as a wake-up call for organizations across all industries to bolster their security defenses.
## Equifax Data Breach explained: what happened?
The Equifax data breach occurred when attackers exploited a known vulnerability in the company’s web application software. First discovered in July 2017, this breach compromised the sensitive data of approximately 147 million people. The stolen information included Social Security numbers, birt
Huntress
Ten Years of Resilience, Innovation & Community-Driven Defense | Huntress
blogs_huntress·CVSS 8.8
[HIGH] Ten Years of Resilience, Innovation & Community-Driven Defense | Huntress
The world of cybersecurity has been a wild ride over the last decade. As attackers stepped up their game year over year, the security community responded and adapted with resilience and ingenuity to each new wave of threats.
Attackers tested our limits time and time again with bolder, more cutting-edge cyberattacks: ransomware, supply chain compromises, zero-day vulnerabilities, and more. But every single breach, compromise, and exploited vulnerability taught us something new, pushed us harder to innovate and stay steps ahead, brought our security community closer together, and rallied us to wreck hackers.
As we celebrate our 10th anniversary at Huntress this month, we’re pausing to look back at the events that have shaped the entire cybersecurity community. Understanding where we've bee
Huntress
CVE-2017-5638 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 9.8
CVE-2017-5638 [CRITICAL] CVE-2017-5638 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2017-5638 Vulnerability
Published: 12/16/2025
Written by: Lizzie Danielson
## What is CVE-2017-5638 vulnerability?
CVE-2017-5638 is a critical remote code execution (RCE) vulnerability in Apache Struts 2, identified as a flaw in the Jakarta Multipart parser. This vulnerability allows attackers to execute arbitrary commands on affected servers by exploiting improper exception handling during file uploads. Due to its severe potential consequences, CVE-2017-5638 has been widely exploited in the wild since its disclosure.
## When was it discovered?
CVE-2017-5638 was publicly disclosed on March 6, 2017, with credits for its discovery attributed to the Apache Struts security team. Exploitation in real-world scenarios, including major campaigns, occurred almost immediately after the
Bugzilla
CVE-2017-5638 struts2: RCE when performing file upload based on Jakarta Multipart parser
bugzilla·2017-03-08·CVSS 9.8
CVE-2017-5638 [CRITICAL] CVE-2017-5638 struts2: RCE when performing file upload based on Jakarta Multipart parser
CVE-2017-5638 struts2: RCE when performing file upload based on Jakarta Multipart parser
It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to display an error message to a user.
External References:
https://cwiki.apache.org/confluence/display/WW/S2-045
References:
https://github.com/rapid7/metasploit-framework/issues/8064
Discussion:
It doesn't appear that Satellite version 5.x is affected (struts 1) either. Thread 15aa3463cdf3ff5f.
---
Statement:
A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, us
OWASP
A06 2021 Vulnerable And Outdated Components
owasp
A06 2021 Vulnerable And Outdated Components
{%- set parent = extra.osib.document ~ "." ~ extra.osib.version -%}
{%- set osib = parent ~ ".6" -%}
#A06:2021 – Vulnerable and Outdated Components {: style="height:80px;width:80px" align="right"} {{ osib_anchor(osib=osib, id=id, name="Vulnerable and Outdated Components", lang=lang, source=source, parent=parent, predecessor=extra.osib.document ~ ".2017.9") }}
## Factors {{ osib_anchor(osib=osib ~ ".factors", id=id ~ "-factors", name=title ~ ": Factors", lang=lang, source=source ~ "#" ~ id, parent=osib) }}
| CWEs Mapped | Max Incidence Rate | Avg Incidence Rate | Max Coverage | Avg Coverage | Avg Weighted Exploit | Avg Weighted Impact | Total Occurrences | Total CVEs |
|:-------------:|:--------------------:|:--------------------:|:--------------:|:--------------:|:----------------------
OWASP
A06:2021 – Vulnerable and Outdated Components
owasp
A06:2021 – Vulnerable and Outdated Components !icon{: style="height:80px;width:80px" align="right"}
# A06:2021 – Vulnerable and Outdated Components {: style="height:80px;width:80px" align="right"}
## Factors
| CWEs Mapped | Max Incidence Rate | Avg Incidence Rate | Max Coverage | Avg Coverage | Avg Weighted Exploit | Avg Weighted Impact | Total Occurrences | Total CVEs |
|:-------------:|:--------------------:|:--------------------:|:--------------:|:--------------:|:----------------------:|:---------------------:|:-------------------:|:------------:|
| 3 | 27.96% | 8.77% | 51.78% | 22.47% | 5.00 | 5.00 | 30,457 | 0 |
## Overview
It was #2 from the Top 10 community survey but also had enough data to make the
Top 10 via data. Vulnerable Components are a known issue that we
struggle to test and assess risk and is the only category to not have
any Common Vulnerability and Exposures (CVE
OWASP
A9:2017 Using Components with Known Vulnerabilities
owasp
A9:2017 Using Components with Known Vulnerabilities
# A9:2017 Using Components with Known Vulnerabilities
| Threat agents/Attack vectors | Security Weakness | Impacts |
| -- | -- | -- |
| Access Lvl : Exploitability 2 | Prevalence 3 : Detectability 2 | Technical 2 : Business |
| While it is easy to find already-written exploits for many known vulnerabilities, other vulnerabilities require concentrated effort to develop a custom exploit. | Prevalence of this issue is very widespread. Component-heavy development patterns can lead to development teams not even understanding which components they use in their application or API, much less keeping them up to date. Some scanners such as retire.js help in detection, but determining exploitability requires additional effort. | While some known vulnerabilities lead to only minor impacts, some of th
OWASP
A03:2025 Software Supply Chain Failures
owasp
A03:2025 Software Supply Chain Failures !icon{: style="height:80px;width:80px" align="right"}
# A03:2025 Software Supply Chain Failures {: style="height:80px;width:80px" align="right"}
## Background.
This was top-ranked in the Top 10 community survey with exactly 50% respondents ranking it #1. Since initially appearing in the 2013 Top 10 as "A9 – Using Components with Known Vulnerabilities", the risk has grown in scope to include all supply chain failures, not just ones involving known vulnerabilities. Despite this increased scope, supply chain failures continue to be a challenge to identify with only 11 Common Vulnerability and Exposures (CVEs) having the related CWEs. However, when tested and reported in the contributed data, this category has the highest average incidence rate at 5.19%. The relevant CWEs are *CWE-477: Use of Obsolete Function, CWE-1104: Use of Unmaintained Th
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlhttp://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txthttp://www.eweek.com/security/apache-struts-vulnerability-under-attack.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.securityfocus.com/bid/96729http://www.securitytracker.com/id/1037973https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/https://cwiki.apache.org/confluence/display/WW/S2-045https://cwiki.apache.org/confluence/display/WW/S2-046https://exploit-db.com/exploits/41570https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519ahttps://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228https://github.com/mazen160/struts-pwnhttps://github.com/rapid7/metasploit-framework/issues/8064https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_ushttps://isc.sans.edu/diary/22169https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Ehttps://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.htmlhttps://packetstormsecurity.com/files/141494/S2-45-poc.py.txthttps://security.netapp.com/advisory/ntap-20170310-0001/https://struts.apache.org/docs/s2-045.htmlhttps://struts.apache.org/docs/s2-046.htmlhttps://support.lenovo.com/us/en/product_security/len-14200https://twitter.com/theog150/status/841146956135124993https://www.exploit-db.com/exploits/41614/https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/https://www.kb.cert.org/vuls/id/834067https://www.symantec.com/security-center/network-protection-security-advisories/SA145http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlhttp://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txthttp://www.eweek.com/security/apache-struts-vulnerability-under-attack.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.securityfocus.com/bid/96729http://www.securitytracker.com/id/1037973https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/https://cwiki.apache.org/confluence/display/WW/S2-045https://cwiki.apache.org/confluence/display/WW/S2-046https://exploit-db.com/exploits/41570https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519ahttps://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228https://github.com/mazen160/struts-pwnhttps://github.com/rapid7/metasploit-framework/issues/8064https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_ushttps://isc.sans.edu/diary/22169https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Ehttps://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.htmlhttps://packetstormsecurity.com/files/141494/S2-45-poc.py.txthttps://security.netapp.com/advisory/ntap-20170310-0001/https://struts.apache.org/docs/s2-045.htmlhttps://struts.apache.org/docs/s2-046.htmlhttps://support.lenovo.com/us/en/product_security/len-14200https://twitter.com/theog150/status/841146956135124993https://www.exploit-db.com/exploits/41614/https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/https://www.kb.cert.org/vuls/id/834067https://www.symantec.com/security-center/network-protection-security-advisories/SA145https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638
2017-03-11
Published
2021-11-03
Added to CISA KEV
Exploited in the wild