Apache Zero-Day Vulnerability
This content has been archived
This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk
Summary
Affected platforms
The following platforms are known to be affected:
Threat details
The remote code execution vulnerability occurs in the Jakarta Multipart parser due to improper handling of the Content-Type header. Successful exploitation could result in execution of arbitrary code on the targeted system. An attacker can use malicious OGNL (Object-Graph Navigation Language) in Content-Type header to exploit this vulnerability and then execute the system command.
The attackers are able to carry out a variety of malicious attacks including injecting code into webpages. This results in the firewall protection of the server stopping which then allows malware to be downloaded. The attacks are using a publicly released Proof-Of-Concept (POC) to run various commands that range from “whoami” to more refined commands which can download and run malicious executables.
CVE Identifier:
Affected versions:
- Apache Struts 2.3.5 – 2.3.31
- Apache Struts 2.5 – 2.5.10
Remediation steps
CVE Vulnerabilities
Last edited: 17 February 2020 11:26 am