Equifax Says Unpatched Apache Struts Flaw Behind Massive Security Breach

Equifax officials said today that its massive security breach was possible via unpatched web application server vulnerability Apache Struts CVE-2017-5638, confirming what some in the security community expected to be the case last week when the news first broke.

In an update to its FAQ page on EquifaxSecurity2017.com, officials said it has been working with an independent cybersecurity firm to determine what information was accessed and which customers have been impacted.

Equifax announced last Thursday that personal information belonging to 143 million customers was accessed by hackers, in addition to credit card numbers for about 209,000 consumers. Beyond facing its customers wrath in the days that have followed, Equifax is now also subject to an FTC investigation. 

“We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement,” Equifax said.

Apache Struts CVE-2017-5638 was made public on March 7, 2017, and a patch was made available that day. In a statement today, Apache said “the Equifax data compromise was due to their failure to install the security updates provided in a timely manner.”

Equifax discovered the breach on July 29 and didn’t disclose when it sought to patch the flaw, Bloomberg says.

In a blog post by Contrast Security CTO Jeff Williams last week, he said that while ensuring you don’t use libraries with known vulnerabilities is a good practice, it is not easy since changes come out frequently.

“Often these changes require rewriting, retesting, and redeploying the application, which can take months. I have recently talked with several large organizations that took over four months to deal with CVE-2017-5638. Even in the best run organizations, there is often a gap of many months between vulnerability disclosure and updates being made to applications,” Williams wrote.

A statement from Apache Struts VP René Gielen on Saturday, before Equifax confirmed what caused the security breach, said:

In the post, Gielen outlines five best practices for using open or closed source supporting library in software products and services:

1. Understand which supporting frameworks and libraries are used in your software products and in which versions. Keep track of security announcements affecting this products and versions.

2. Establish a process to quickly roll out a security fix release of your software product once supporting frameworks or libraries needs to be updated for security reasons. Best is to think in terms of hours or a few days, not weeks or months. Most breaches we become aware of are caused by failure to update software components that are known to be vulnerable for months or even years.

3. Any complex software contains flaws. Don't build your security policy on the assumption that supporting software products are flawless, especially in terms of security vulnerabilities.

4. Establish security layers. It is good software engineering practice to have individually secured layers behind a public-facing presentation layer such as the Apache Struts framework. A breach into the presentation layer should never empower access to significant or even all back-end information resources.

5. Establish monitoring for unusual access patterns to your public Web resources. Nowadays there are a lot of open source and commercial products available to detect such patterns and give alerts. We recommend such monitoring as good operations practice for business critical Web-based services.