SoylentNews is people
SoylentNews
Submitted via IRC for SoyCow1937
A vulnerability affecting the Apache Struts 2 open-source development framework was reportedly used to breach U.S. credit reporting agency Equifax and gain access to customer data.
Equifax revealed last week that hackers had access to its systems between mid-May and late July. The incident affects roughly 143 million U.S. consumers, along with some individuals in the U.K. and Canada.
The compromised information includes names, social security numbers, dates of birth, addresses and, in some cases, driver's license numbers. The credit card numbers of roughly 209,000 consumers in the United States and dispute documents belonging to 182,000 people may have also been stolen by the attackers.
Equifax only said that "criminals exploited a U.S. website application vulnerability to gain access to certain files." However, financial services firm Baird claimed the targeted software was Apache Struts, a framework used by many top organizations to create web applications.
"Our understanding is that data entered (and retained) through consumer portals/interactions (consumers inquiring about their credit reports, disputes, etc.) and data around it was breached via the Apache Struts flaw," Baird said in a report.
Some jumped to conclude that it was the recently patched and disclosed CVE-2017-9805, a remote code execution vulnerability that exists when the REST plugin is used with the XStream handler for XML payloads. This flaw was reported to Apache Struts developers in mid-July and it was addressed on September 5 with the release of Struts 2.5.13.
The security hole is now being exploited in the wild, but there had been no evidence of exploitation before the patch was released.
Source: http://www.securityweek.com/apache-struts-flaw-reportedly-exploited-equifax-hack
(Score: 4, Interesting) by goodie on Tuesday September 12 2017, @02:21PM
was "wow, people still actively use Struts?". Not that I don't think it is a good framework. In principle it works well, but my experience with it was rather debilitating after a while. the idea that you can create navigation rules and bind your view to a model is quite interesting, but it is rather rigid and, back when we used it, still had some cross-browser compatibility issues. In any case, it's interesting to hear that name. We used it back in 2006 or so and we let it go after a bit to move to jsf, which we then dropped as well. Both projects are interesting, but not great for enterprise-grade applications in our experience. You will need to work around the framework a lot to enable certain things if your "webapp" is not static, page by page.
That brought me back though :D