Pierluigi Paganini
March 14, 2017
The Canada Revenue Agency (CRA) confirmed it shut down its website for filing federal taxes after hackers broke into the server at the nation’s statistics bureau. The security breach occurred last week and attackers exploited the recently discovered CVE-2017-5638 flaw in Apache Struts 2.
The CVE-2017-5638 flaw is a remote code execution zero-day that has been exploiting by attackers in the wild, it affects Struts 2.3.5 through 2.3.31 and Struts 2.5 through 2.5.10.
The issue was first spotted by the Chinese developer Nike Zheng, the attack sends an invalid Content-Type value to the uploader throwing an exception creating the condition for the remote code execution.
The issue is documented at Rapid7’s Metasploit Framework GitHub site and attackers in the wild are exploiting a publicly available PoC code that triggers the vulnerability.
“Talos has observed a new Apache vulnerability that is being actively exploited in the wild. The vulnerability (CVE-2017-5638) is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, referenced in this security advisory.” reads the security advisory published by the Talos group. “Talos began investigating for exploitation attempts and found a high number of exploitation events.”
According to the experts from Cisco Talos, the flaw affects the Jakarta-based file upload Multipart parser under Apache Struts 2.
This week, Cisco confirmed that the vulnerability affects the Cisco Identity Services Engine (ISE), the Prime Service Catalog Virtual Appliance, and the Unified SIP Proxy Software.
The Canada Revenue Agency publicly confirmed in a press conference held in Ottawa yesterday that the CVE-2017-5638 affecting Apache Struts 2 was exploited by hackers to shut down its services over the weekend.
Federal government officials declared that no personal information was compromised due to the cyber attack on the Canada Revenue Agency’s online tax services.
“Due to our quick and proactive approach, we’re confident that we’ve prevented government information, including the personal information of Canadians, from being breached,” Jennifer Dawson, deputy chief information officer for the Treasury Board of Canada Secretariat said. “We’ve seen no evidence of this information being compromised.”
John Glowacki, chief operating officer of Shared Services Canada, confirmed that the CVE-2017-5638 flaw in Apache Struts 2 poses “specific and credible threat” to certain government IT systems worldwide.
“We will not speak for other countries, but we will say we have information that some other countries are having greater problems with this specific vulnerability,” Glowacki added.
The Canadian authorities informed that the Statistics Canada’s Website was taken down last Thursday in order to fix the issue.
IT vendors are investigating their products about the possible impact of the flaw in Apache Struts 2, after Cisco also VMware has issuing a security advisory warning of the impact on Horizon Desktop as-a-Service, vCenter Server, vRealize Operations Manager and vRealize Hyperic Server solutions.
[adrotate banner=”9″]
(Security Affairs – Apache Struts 2, Canada Revenue Agency)
