Hackers drop crypto mining on vulnerable Struts

Researchers have recorded the first mass automated attacks against servers running unpatched versions of the open source Apache Struts enterprise web application framework.

The new vulnerability in Apache Struts was made public four days ago and allows for remote code execution.

Apache has issued patched versions of Struts, version 2.3.35 and 2.5.17, but many administrators have failed to apply the fixed software.

Security vendor Volexity said the scans and exploit attempts started soon after security researcher Prajwal Panchmahalkar released a proof of concept Python script for the vulnerability on Github.

If the exploit code executes successfully on a vulnerable Apache Struts installation, wget requests run to fetch a copy of CNRig Miner - a cryptocurrency miner that runs on Linux distributions - again from Github.

The attacks would also plant a script on vulnerable systems that downloads further Linux ELF binaries for Intel, ARM and MIPS processors.

Volexity said this shows the cryptocurrency miner is capable of running on a wide range of hardware, such as servers, desktops, laptops, IoT devices, wireless routers and other internet connected devices with vulnerable instances of Apache Struts.

Initial scans have come from Russian and French internet protocol addresses, Volexity said.

Volexity warned that while the current round of attacks compromised equipment with cryptocurrency mining payloads, unpatched Apache Struts installations left organisations open to significant risks, including advanced persistent threat (APT) state-sponsored hacking groups gaining access to networks.

Security engineer Dino A Dai Zovi at payments company Square suggested on Twitter a number of common-sense security measures that could mitigate against successful exploitation of the current Apache Struts vulnerability and others that might follow it, on top of patching:

After patching this vuln, a few good questions to ask are:

- why are our web services allowed to connect directly to external Internet hosts from production?

- why are our web services allowed to execute dynamically downloaded binaries?

- why isn’t /tmp mounted noexec?

— Dino A. Dai Zovi (@dinodaizovi) August 27, 2018