Case Study - Equifax and Apache Struts

MVC is a design pattern for developing user interfaces, as shown here.

Updates e.g. list item to show added item

Model Defines data structure e.g. updates application to

refect added tem

Manipulates

Defines display (UI) e.g. user clicks "add to cart"

Controller

Sends input from user Contains control logic e.g. receives update from view then notifies model to "add item" Sometimes updates directly

Struts separates the element that communicates with a Java database (the model) from the hypertext markup language (HTML) page, which is the information the client interacts with (the view). This breaks from the traditional Java web application, which allows a user to directly call the server from a web-based form.

On March 10, 2017, the U.S. National Vulnerability Database (NVD) issued a Common Vulnerabilities and Exposures (CVE) critical notification (CVE-2017-5638). This detailed a vulnerability in the Jakarta multipart parser, which allowed remote execution of arbitrary code by malicious actors.

A further vulnerability notification was issued in 2018 under a security advisory (MS-ISAC 2018- 093) by the Center for Internet Security (CIS).

The CIS identified the risk level for users as low, but for government and business, the risk level was high.

The Struts framework flaw was fixed on March 6, 2017, but within days of identifying the bug, attackers were trying to exploit the vulnerability (unknown at the time) and the remote code execution capabilities to install malicious software on web servers.

In May 2017, two months after the patch was released, a web application vulnerability in Struts led to Equifax suffering a data breach that exposed the sensitive information of 143 million U.S. citizens.

Data accessed in the breach included names, Social Security numbers, birth dates, addresses, driver's license numbers, credit card numbers, dispute documents. Information on UK and Canadian residents was also accessed.