Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
From: Martin Gainty <mgainty@hotmail.com>
To: Struts Developers List <dev@struts.apache.org>
Subject: Re: S2 makes Hacker News :/
Thread-Topic: S2 makes Hacker News :/
Thread-Index: AQHSmOPkfWBma/NTF0Ct38A9NfkkZqGMmysAgAeqlYCAABCjAIAAHk2AgAA4HgCAAo4hgIAANz3u
Date: Thu, 16 Mar 2017 12:45:26 +0000
Message-ID: <BLUPR14MB02597A49BCB3963709336E69AE260@BLUPR14MB0259.namprd14.prod.outlook.com>
References: <CADJJoV6BqbBBoUVsfNraYGc8eTFR8vrFZHmE2qpfkaev0U2eKw@mail.gmail.com>
 <CAMopvkM-WzJtymN+CLVHTj5SURrEYO8sh3XcU69sb8zvmm=7fA@mail.gmail.com>
 <96f74fdb-38ce-3e0e-0b51-b268cebe5b10@apache.org>
 <CAJxTgscQ+Tq1mSYJoNNA+haLZVWhybELk4mA5u4ef-A6TkA80A@mail.gmail.com>
 <36B9A2AC-9C13-4317-840A-605760414DE7@part.net>
 <CAMopvkMxWtb635QR2xOS1yakLM-vR90uYBjg4F8_tga7i0kheg@mail.gmail.com>,<CAJi=3dUVNV48m=+9AWHPugPesAV1hm1ommGkTmcUoPxbxcw2=A@mail.gmail.com>
In-Reply-To: <CAJi=3dUVNV48m=+9AWHPugPesAV1hm1ommGkTmcUoPxbxcw2=A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [Zg/kj1ea1TAqqYMdoMAiSenhjIIndUsP]
x-microsoft-exchange-diagnostics: 1;BN3NAM04HT081;5:IdEUymZBccjCbPznOGeicMtkHy0GLULf6ky9wEFAYu7GhNh/mPGzkTwwaYAeNph5ar2sX013LPW5ZH59mkgj7yEMQc29c9XqU9rodxFZGisikCyWAcHOhVEyoI/Hbv8T4vjfw+N1+emk06vqHS84Kg==;24:x3EN6TmyBHeKJ5yZ0jl32jHMa9fB6z/8Md2GsTGHVz4Y8WrGTu5Tu+2zkvu1BjWcEQx2i7sCBSWary3PGneEce8aUGMEUkDd0SWcexmVfig=;7:5kuyv15IArM9RUQ9DAGFkxOdX5t0YwDVzUWINC2ZdXa25MPaenbEFVsxMoQrhtMuyjYksAdo2sT40GU8RyB6PKpLWXHwvOt1k0qJCAKR2OTvV8oBmYJpOgjIrxNVozFLEw1AiyKHTjvSW+mQHjoEZaTp4oZrPox6NSnjTJjRLHZOj6BoxBDTPHHuZHIXm4nCt4lExt6mu8jX5A3XZSGc8iu4R05tsXbm0cvRa54X4ULuso3FFMNGuB5HrhNRSk14X2bdJiQGBD3SaNNODhlXGMRjpj+lPbm+sse6etIFBgShBI3DJPcpW5jeA3J28hPI
x-incomingheadercount: 42
x-eopattributedmessage: 0
x-forefront-antispam-report: EFV:NLI;SFV:NSPM;SFS:(10019020)(98900017);DIR:OUT;SFP:1102;SCL:1;SRVR:BN3NAM04HT081;H:BLUPR14MB0259.namprd14.prod.outlook.com;FPR:;SPF:None;LANG:en;
x-ms-office365-filtering-correlation-id: c4cc6285-c2df-4f09-8243-08d46c6a5204
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(1601125254)(1603101448)(1701031045);SRVR:BN3NAM04HT081;
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(432015242)(444000031);SRVR:BN3NAM04HT081;BCL:0;PCL:0;RULEID:;SRVR:BN3NAM04HT081;
x-forefront-prvs: 024847EE92
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_BLUPR14MB02597A49BCB3963709336E69AE260BLUPR14MB0259namp_"
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Mar 2017 12:45:26.3192
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3NAM04HT081
X-OriginalArrivalTime: 16 Mar 2017 12:45:27.0325 (UTC) FILETIME=[3013E4D0:01D29E53]
archived-at: Thu, 16 Mar 2017 12:45:41 -0000

--_000_BLUPR14MB02597A49BCB3963709336E69AE260BLUPR14MB0259namp_
Content-Type: text/plain; charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable


________________________________
From: Greg Huber <gregh3269@gmail.com>
Sent: Thursday, March 16, 2017 5:19 AM
To: Struts Developers List
Subject: Re: S2 makes Hacker News :/

Just because you are using s2, does not necessarily mean you are affected,
all I get is a response :

HTTP/1.1 404
Content-Length: 0
Date: Thu, 16 Mar 2017 09:02:54 GMT
Connection: close

Looking at my logs this fishing is going on all the time.

MG>from what i read injections only happen with Content-Type injection

MG>then again patches  Struts 2.3.32 or 2.5.10.1 has been available for som=
e time

MG>Johannes suggests implementing 'snort' to detect injection vulnerability=
 reference link at sans.edu below:
https://isc.sans.edu/forums/diary/Critical+Apache+Struts+2+Vulnerability+Pa=
tch+Now/22169/

MG>Thanks Lukasz!

Thanks also Lukasz for the quick fix.

Cheers Greg


On 14 March 2017 at 18:17, Lukasz Lenart <lukaszlenart@apache.org> wrote:

> 2017-03-14 15:57 GMT+01:00 Doug Erickson <erickson@part.net>:
> > What is the proper server setup to prevent this?
>
> Upgrade to the latest Struts version ... and run server on a dedicated
> account, block access to the world (sever should be only allowed to
> connect to localhost) and few other things
>
>
> Regards
> --
> =A3ukasz
> + 48 606 323 122 http://www.lenart.org.pl/
=A3ukasz Lenart - strona domowa<http://www.lenart.org.pl/>
www.lenart.org.pl
pasja ci=B1gle co=B6 nowego. programowanie, tworzenie jest dla mnie =BFycio=
w=B1 pasj=B1, jak dot=B1d udaje mi sie =B3=B1czy=E6 to co lubi=EA z tym za =
co mi p=B3ac=B1 i ...


>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>

--_000_BLUPR14MB02597A49BCB3963709336E69AE260BLUPR14MB0259namp_--