An Analysis of CVE-2017-5638 – how Equifax was hacked
blog.gdssecurity.com
An Analysis of CVE-2017-5638 – how Equifax was hacked
1–10 of 21 posts
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#2Wow, article is from March 2017.
Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header.
There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to process the exception. This generic handler turns out to parse the unsanitized user input as OGNL markup, running the attacker code when processing the exception text.
Some effort is made to blacklist loading other Java libraries in the text rendering context, however it was easily defeated by emptying the blacklist in the attacking code before calling the blacklisted modules.
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#3Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
Beautiful summary.
Thank you.
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#4Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
Agreed - great write up, but can you expand on this a bit more please?
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#5Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
Agreed - great write up, but can you expand on this a bit more please?
[deleted]
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#6Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
Agreed - great write up, but can you expand on this a bit more please?
Ah, I probably should have used a TL;DR tag - my original comment is just a really condensed summary of the awesome but super detailed article, which even shows and explains the Struts code in question, example requests and responses, stack traces from the exception, and the exception logs. Even in the comments are some logs that look like evidence of an actual in-the-wild RCE attempt!
So maybe check there for more explanation... all credit for the research and investigation goes to the article's author. It was really a good 'deep dive' into the internals of Struts to see how such a subtle bug could be turned into RCE.
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#7Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
This generic handler turns out to parse the unsanitized user input as OGNL markup
The article is pretty dense and I don't understand this point. I can maybe understand why you'd want to parse the output of an exception message, but why would you ever want to be executing what you parse?
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#8Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
This generic handler turns out to parse the unsanitized user input as OGNL markup The article is pretty dense and I don't understand this point. I can maybe understand why you'd want to parse the output of an exception message, but why would you ever want to be executing what you parse?
I don't know either, so I googled [OGNL] and the instant answer snippet was
> OGNL stands for Object-Graph Navigation Language; it is an expression language for getting and setting properties of Java objects, plus other extras such as list projection and selection and lambda expressions. You use the same expression for both getting and setting the value of a property.
Which makes it pretty clear.
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#9Wow, article is from March 2017. Summary: Attacker sends a malformed Content-Type header on file upload, which throws an exception due to the Content-Type being unknown. But, in the exception text is the direct, unsanitized user input from the header. There is not a specific text localization handler for struts.messages.upload.error.InvalidContentTypeException, so a generic exception handler ends up being used to pro…
So basically they called eval() on an error message, to put it bluntly? Nice reminder that no matter how safe the language, people will do nutty stuff with it.
Re: An Analysis of CVE-2017-5638 – how Equifax was hacked
#10I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?