Hello, welcome to the Thursday, August 23rd, 2018 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and the day I'm recording from Stockheim, Germany.

Never a good day if you have a new vulnerability in struts that can lead to remote code execution. This vulnerability CVE 2018 11776 was found by

SAML security research. They also have found a couple of the earlier vulnerabilities that, for example,

led to some of these large breaches like for example Equifax.

Now what helps a little bit here is that not everybody running struts is necessarily

vulnerable. You have to have the always select full namespace flag set to true. This isn't

done usually but if you have the convention plugin install

for struts, then this is likely the case for your application. Secondly, your application

needs to use an action that is configured without specifying a namespace according to a

SAML. Wildcard namespaces aren't going to solve the problem, so you will still be vulnerable in this case.

Now, this typically for any actions that you specify in your Struts configuration file,

and if you're using the Struts Convention plugin, then this could also happen for namespaces specified in the Java code.

Okay, so this sounds quite abstract.

Let me give you a more specific example from the Samuel Advisory, and that's a redirect action.

You configure a redirect where a user is being sent to a different URL within your struts application.

Well, in this case, you are vulnerable, again, if you're using the struts convention plugin.

The next thing you're probably going to ask is, is there proof of concept exploit out there?

And yes, there is.

I've seen proof of concept exploit, for example, on Reddit and such. It's very simple,

actually, in particular, for the redirect exploit. All you need to do is include the command that you

would like to execute as part of the URL. So what should you do? Well, if you have no idea if you are using the strats conventions or if it's configured in a vulnerable way, I would recommend update.

It probably will take you too long to figure out how all of your applications are configured and if they're vulnerable by then you're already

...