Struts2 Under Attack: New Vulnerability Exploited in the Wild

2024-12-15

Cybercriminals are actively targeting a critical vulnerability (CVE-2024-53677) in Apache Struts2, a popular framework for building web applications. This flaw allows attackers to upload malicious files and potentially take control of vulnerable systems.

This article dives into the recent exploit attempts inspired by the vulnerability and analyzes its technical details.

A critical path traversal vulnerability (CVE-2024-53677) was discovered in Apache Struts2, allowing attackers to potentially upload malicious files and execute code remotely.
The vulnerability appears related to a previous one (CVE-2023-50164) and might be a result of an incomplete patch.
Exploit attempts have been observed in the wild, targeting vulnerable systems and attempting to upload malicious scripts.
Patching requires rewriting actions to use the new file upload mechanism, making the process less straightforward.

What Undercode Says:

This recent vulnerability in Struts2 highlights the importance of keeping your web applications up-to-date. Unpatched systems are easy targets for attackers, who can exploit vulnerabilities to gain unauthorized access and potentially compromise sensitive data.

Here’s a deeper analysis of the situation:

Severity: The vulnerability scores a high 9.5 on the CVSS scale, indicating a severe risk. Attackers can exploit it to upload malicious code and potentially take complete control of vulnerable servers.
Exploitation Attempts: The observed exploit attempts closely resemble the Proof-of-Concept (PoC) exploit code released online. This suggests attackers are actively scanning for vulnerable systems and using readily available tools.
Patching Challenges: Patching this vulnerability requires a change in how applications handle file uploads. While this offers better security, it also necessitates rewriting actions, adding complexity to the update process.
Limited Scope (For Now): So far, exploit attempts seem to originate from a single IP address. However, this doesn’t guarantee it won’t become more widespread.

Recommendations:

Update Immediately: If you are using Struts2, prioritize patching your applications with the latest version (2.5.33 or 6.3.0.2 or higher) to mitigate the risk of exploitation.
Security Audits: Conduct regular security audits to identify and address vulnerabilities in your web applications.
Stay Informed: Keep yourself updated on the latest security threats and vulnerabilities to ensure your systems remain protected.

By following these recommendations, you can significantly reduce the risk of being compromised by this and similar vulnerabilities in the future.