Apache Struts and the Equifax data breach 2021-06-03

Apache Struts and the Equifax data breach
June 3, 2021
#security
#java

Transcript

1. Sean Sulliva
   n
   
   June 3, 2021
   

   View Slide

2. September 7, 2017
   

   View Slide

3. www.equifax.com
   

   View Slide

4. Last Week Tonight — October 15, 2017
   

   View Slide

5. Last Week Tonight — October 15, 2017
   

   View Slide

6. View Slide

7. View Slide

8. View Slide

9. We know that criminals exploited a US website
   application vulnerability.
   
   
   The vulnerability was Apache Struts CVE-2017-5638
   .
   
   September 2017
   

   View Slide

10. https://nvd.nist.gov
    

    View Slide

11. The Jakarta Multipart parser in Apache Struts 2
    2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has
    incorrect exception handling and error-message
    generation during
    fi
    le-upload
    
    
    CVE-2017-5638
    

    View Slide

12. allows remote attackers to execute
    arbitrary command
    s
    
    CVE-2017-5638
    

    View Slide

13. via a crafted Content-Type, Content-Disposition,
    or Content-Length HTTP header, as exploited in
    the wild in March 2017 with a Content-Type
    header containing a #cmd= strin
    g
    
    CVE-2017-5638
    

    View Slide

14. http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
    Malicious payload in Content-Type header
    

    View Slide

15. Struts 2.x internals
    

    View Slide

16. OGNL expressions
    

    View Slide

17. com.opensymphony.xwork2.ognl.OgnlUtil
    

    View Slide

18. ognl.OgnlRuntime
    

    View Slide

19. import java.lang.re
    fl
    ect.*
    ;
    
    public static Object invokeMethod
    (
    
    Object target
    ,
    
    Method method,
    
    
    Object[] argsArray
    )
    
    OgnlRuntime.java
    

    View Slide

20. Untrusted user inpu
    t
    
    +
    
    OGNL librar
    y
    
    

    View Slide

21. Struts
    2
    
    internal security
    

    View Slide

22. View Slide

23. View Slide

24. View Slide

25. June 2018
    

    View Slide

26. September 9, 2017
    

    View Slide

27. September 14, 2017
    

    View Slide

28. October 3, 2017
    

    View Slide

29. security advic
    e
    
    from th
    e
    
    Apache Software Foundation
    

    View Slide

30. Understand which supporting frameworks and
    libraries are used in your software products and
    in which versions.
    
    
    Keep track of security announcements affecting
    this products and versions
    .
    
    apache.org — September 9, 2017
    

    View Slide

31. Establish a process to quickly roll out a security
    fi
    x release of your software product once
    supporting frameworks or libraries needs to be
    updated for security reasons
    .
    
    apache.org — September 9, 2017
    Best is to think in terms of hours or a few days,
    not weeks or months.
    

    View Slide

32. Any complex software contains
    fl
    aws.
    
    
    Don't build your security policy on the
    assumption that supporting software products
    are
    fl
    awless
    apache.org — September 9, 2017
    

    View Slide

33. Establish security layers
    .
    
    It is good software engineering practice to have
    individually secured layers behind a public-
    facing presentation layer such as the Apache
    Struts framework.
    apache.org — September 9, 2017
    

    View Slide

34. Establish monitoring for unusual access
    patterns to your public web resources.
    
    
    apache.org — September 9, 2017
    

    View Slide

35. Automatic patching?
    

    View Slide

36. I have talked to other software companies and people in
    this space who say some companies have an automated
    system that when a patch comes out it automatically gets
    installed.
    
    
    That is not what you had necessarily, right
    ?
    
    Rep Greg Walde
    n
    
    October 3, 2017
    

    View Slide

37. I am unaware of an automatic patch
    .
    
    Richard Smit
    h
    
    former Equifax CE
    O
    
    October 3, 2017
    

    View Slide

38. automatic
    dependency
    updates?
    

    View Slide

39. https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/
    Dependabot
    

    View Slide

40. https://github.com/scala-steward-org/scala-steward
    

    View Slide

41. https://snyk.io/
    Snyk
    

    View Slide

42. How can I learn
    more about web
    application
    security?
    

    View Slide

43. www.owasp.org
    

    View Slide

44. Conclusion
    • establish security layer
    s
    
    • automate dependency update
    s
    
    • monitor for unusual access pattern
    s
    
    • encrypt sensitive data
    

    View Slide

45. questions?
    

    View Slide

46. THE END
    

    View Slide

47. Bonus slides
    

    View Slide

48. Ars Technica — September 13, 2017
    

    View Slide

49. View Slide