Critical Apache Struts Flaw Detected, Exploits Underway

December 18, 2024December 18, 2024

Critical Apache Struts Vulnerability CVE-2024-53677 Exposes Systems to Remote Code Execution

A newly uncovered security vulnerability in Apache Struts, identified as CVE-2024-53677, poses a significant risk to organizations utilizing this widely adopted framework. With a critical CVSS score of 9.5 out of 10, this flaw could enable threat actors to execute remote code on affected systems. Understanding this vulnerability and taking immediate action is essential for maintaining the security of your IT infrastructure.

Understanding CVE-2024-53677 and Its Implications

CVE-2024-53677 allows attackers to exploit file upload parameters, potentially leading to path traversal vulnerabilities. As noted in the Apache advisory, successful exploitation could let a malicious actor upload harmful files, which may facilitate remote code execution, data exfiltration, and further attacks. This vulnerability is particularly concerning as it mirrors a previous critical issue, CVE-2023-50164, which was addressed by maintainers just months prior.

Affected Versions of Apache Struts

The vulnerability impacts several versions of Apache Struts, particularly those below version 6.4.0, which has been patched. The following versions are at risk:

Struts 2.0.0 – Struts 2.3.37 (End-of-Life)
Struts 2.5.0 – Struts 2.5.33
Struts 6.0.0 – Struts 6.3.0.2

Expert Insights on the Vulnerability

Dr. Johannes Ullrich from the SANS Technology Institute has raised concerns that an incomplete patch for the prior CVE-2023-50164 may have led to this new vulnerability. He reported that exploitation attempts are already observable in the wild, with attackers actively scanning for vulnerable systems. “Currently, scans appear to originate from a specific IP address, indicating a focused effort to exploit this flaw," Ullrich explained.

Mitigation Strategies for Users

To safeguard against the risks posed by CVE-2024-53677, users are strongly urged to:

Upgrade to Apache Struts version 6.4.0 or later immediately.
Revise their code to utilize the new Action File Upload mechanism along with the related interceptor.

Saeed Abbasi, Product Manager at Qualys, emphasized the significance of this vulnerability, stating, "Apache Struts is integral to many corporate IT environments, and a flaw like CVE-2024-53677 could have widespread repercussions across critical business operations."

Conclusion: Take Action Now

In light of the potential impact of this vulnerability, it’s crucial for organizations using Apache Struts to assess their systems and implement recommended updates without delay. For further reading on related security topics, consider visiting the Apache Security Advisory or exploring our previous articles on software vulnerabilities.

Found this article helpful? Share your thoughts in the comments below and follow us on Twitter and LinkedIn for more exclusive content and updates on cybersecurity trends.

CISA Warns Agencies to Fix Critical Array Networks Flaw

December 1, 2024December 1, 2024

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability, CVE-2023-28461, affecting Array Networks AG and vxAG gateways to its Known Exploited Vulnerabilities catalog due to active exploitation. With a high CVSS score of 9.8, this flaw allows remote code execution without authentication. Array Networks issued patches in March 2023 to mitigate this risk. The inclusion follows reports of the China-linked cyber espionage group Earth Kasha exploiting such vulnerabilities. CISA advises federal agencies to apply necessary patches by December 16, 2024, emphasizing the need for organizations to enhance their cybersecurity measures.

Google’s AI Tool Identifies 26 Vulnerabilities in Open Source

December 1, 2024December 1, 2024

Google’s OSS-Fuzz tool has identified 26 vulnerabilities in open-source code, including a medium-severity flaw in OpenSSL, labeled CVE-2024-9143. This out-of-bounds memory write bug, which could lead to application crashes or remote code execution, has been fixed in recent OpenSSL releases. The integration of AI and large language models into OSS-Fuzz has enhanced its fuzzing coverage, uncovering vulnerabilities that might have remained hidden for years. Additionally, Google is transitioning its codebases to memory-safe languages like Rust and implementing security measures in C++ to mitigate risks, reinforcing their commitment to improving open-source security.

Apache Tomcat Flaw CVE-2024-56337 Allows RCE Attacks

December 24, 2024December 24, 2024

The Apache Software Foundation (ASF) has released a critical security update for its Tomcat server software, addressing a serious vulnerability (CVE-2024-56337) that could enable remote code execution (RCE). This flaw, with a CVSS score of 9.8, is linked to an incomplete fix for another vulnerability (CVE-2024-50379). It primarily affects users on case-insensitive file systems with default servlet write access. Users are advised to update to specific fixed versions and adjust configurations based on their Java versions. Security researchers contributed to identifying these vulnerabilities, highlighting the necessity for prompt action to maintain system security.

Ivanti Releases Urgent Security Updates for CSA and Connect

December 11, 2024December 11, 2024

Ivanti has released critical security updates for its Cloud Services Application (CSA) and Connect Secure products to address multiple high-severity vulnerabilities that could lead to privilege escalation and remote code execution. Key vulnerabilities include an authentication bypass (CVE-2024-11639) and command injection flaws (CVE-2024-11772 and CVE-2024-11634) with CVSS scores reaching 10.0 and 9.1. Users are urged to update to CSA version 5.0.3 or later, Connect Secure version 22.7R2.4 or later, and other recommended versions to mitigate risks. Although no active exploitation is known, vigilance is advised due to potential past attacks.

Mitel MiCollab Flaw Allows Unauthorized File Access

December 5, 2024December 5, 2024

Cybersecurity experts have revealed a proof-of-concept exploit for a critical vulnerability in Mitel MiCollab software, identified as CVE-2024-41713, with a CVSS score of 9.8. This flaw arises from inadequate input validation in the NuPoint Unified Messaging component, enabling attackers to access sensitive files via path traversal. Mitel has released patches in versions 9.8 SP2 or later to address this issue. Additionally, another significant SQL injection vulnerability (CVE-2024-47223) has been identified in the platform. Organizations are urged to update their systems to mitigate these risks and safeguard their data against potential unauthorized access.

Matrix Botnet Targets IoT Devices in Massive DDoS Attack

December 1, 2024December 12, 2024

A newly identified threat actor, Matrix, is leading a significant DDoS campaign targeting IoT devices by exploiting vulnerabilities and misconfigurations. Operating primarily from Russia, Matrix’s attacks focus on IP addresses in China and Japan, alongside other countries, driven by financial motives. The campaign utilizes publicly available tools, including the Mirai botnet and DiscordGo, and has launched a GitHub account to distribute DDoS resources. To mitigate risks, organizations are advised to change default credentials, secure administrative protocols, and regularly update firmware. Concurrently, a new botnet, XorBot, has emerged, targeting specific camera and router brands.