Apache Struts Vulnerability POC Code Found on GitHub
On August 22, 2018, the Apache Software Foundation reported a new vulnerability in the Apache Struts framework (CVE-2018-11776) that could allow an attacker to execute remote code and possibly gain access to a targeted system. The flaw exists because Apache Struts does not perform proper validation of input data. This is a flaw in the Struts framework core, which means all Struts installations are potentially vulnerable.
The vulnerability exists in Struts when a namespace value is not set. The namespace value is how Struts separates the configuration of action into logical modules. The Apache Software Foundation issued a statement explaining the vulnerability as follows:
In practical terms, this means an attacker can exploit the flaw by adding their own namespace to the URL as part of an HTTP request. Unfortunately, this makes the vulnerability trivial to exploit — in fact, proof-of-concept code has already been released, including a Python script that allows for easy exploitation. Recorded Future has also detected chatter in a number of Chinese and Russian underground forums around the exploitation of this vulnerability.
