An Analysis of CVE-2017-5638 – how Equifax was hacked

Post by thephyber » Fri, Sep 22, 2017, 1:45 AM UTC

joatmon-snoo wrote: post #10

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?

Post by nerdponx » Fri, Sep 22, 2017, 2:05 AM UTC

greglindahl wrote: post #8

nerdponx wrote: post #7

Earlier quoted context omitted.

This generic handler turns out to parse the unsanitized user input as OGNL markup The article is pretty dense and I don't understand this point. I can maybe understand why you'd want to parse the output of an exception message, but why would you ever want to be executing what you parse?

I don't know either, so I googled [OGNL] and the instant answer snippet was > OGNL stands for Object-Graph Navigation Language; it is an expression language for getting and setting properties of Java objects, plus other extras such as list projection and selection and lambda expressions. You use the same expression for both getting and setting the value of a property. Which makes it pretty clear.

Post by joatmon-snoo » Fri, Sep 22, 2017, 7:24 AM UTC

thephyber wrote: post #12

joatmon-snoo wrote: post #10

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?

Note that the linked article isn't clickbait. It's an InfoSec description of how they dealt with the same vuln that hit Equifax. The article was written ~6 weeks before Equifax's stated timeline of attack. To clarify your comment, Equifax did recently reveal[1] the specific vuln (CVE-2017-5638) in Apache Struts that was used during the ~May-July attack that caused the most headlines. [1] https://investor.equifax.com/…

Post by speps » Fri, Sep 22, 2017, 9:57 AM UTC

sigmar wrote: post #11

joatmon-snoo wrote: post #10

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?

>The attack vector used in this incident occurred through a vulnerability in Apache Struts (CVE-2017-5638), an open-source application framework that supports the Equifax online dispute portal web application. https://www.equifaxsecurity2017.com ^ the official site, despite looking like a phish There might be more to it, but this vulnerability was definitely used.

Post by deskamess » Fri, Sep 22, 2017, 1:07 PM UTC

ComodoHacker wrote: post #17

nerdponx wrote: post #14

Earlier quoted context omitted.

I still don't get it. Why would you want to execute that kind of markup in an error handler?

To substitute variables in a localized error message template.