Apache Struts & the Equifax breach (CVE-2017-5638)

Apache Struts 2 is a Java web framework. Its Jakarta Multipart parser mishandled the HTTP Content-Type header: put a malicious expression in that header and the server would run it. That meant remote code execution with one request and no login. Apache released the fix on 7 March 2017, and Equifax's administrators were told to apply it on 9 March. The company's online dispute portal was never updated.

Attackers got in through that portal and, from May 2017, moved through Equifax's network for 76 days, taking names, Social Security numbers, birth dates and addresses of about 147 million people. They went unnoticed partly because a tool that inspected encrypted traffic had run on an expired certificate for about ten months. Equifax spotted the intrusion on 29 July 2017, right after renewing it.

Equifax later agreed a settlement of up to $700 million with the FTC, the CFPB and US states. The lessons are about process more than code: know where every framework and library runs, patch internet-facing applications within days, and check that the tools doing the monitoring are actually working.