Apache Struts 2 exploit used to install ransomware on servers
Attackers are exploiting a vulnerability patched last month in the Apache Struts web development framework to install ransomware on servers.
The SANS Internet Storm Center issued an alert Thursday, saying an attack campaign is compromising Windows servers through a vulnerability tracked as CVE-2017-5638.
The flaw is located in the Jakarta Multipart parser in Apache Struts 2 and allows attackers to execute system commands with the privileges of the user running the web server process.
This vulnerability was patched on March 6 in Struts versions 2.3.32 and 184.108.40.206. Attackers started exploiting the flaw almost immediately, leaving very little time for server administrators to deploy the update.