Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

Apache Struts S2-045 (CVE-2017-5638) → Equifax-style breach

Crafted Content-Type header is parsed as OGNL — execute commands as the app user. The 2017 Equifax breach origin: unpatched Struts endpoint exposed to the internet.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target runs a Java app on Apache Struts 2.3 / 2.5 unpatched for S2-045 — a deprecated CVE but still routinely found in legacy / regional financial / telecom apps.

§ Steps

  1. 01
    Bulk customer PII exfilExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Spawn shell as Struts service userExecution
    T1059— Command and Scripting Interpreter
  3. 03
    Pivot to database via app configCredential Access
    T1552— Unsecured Credentials
  4. 04
    Find Struts endpoint (action / Multipart)Reconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  5. 05
    Send malicious Content-Type → OGNL evalInitial Access
    CVE-STRUTS-S2-045— Apache Struts Content-Type RCE (S2-045 / CVE-2017-5638)

§ References

§ Frequently asked

What is the "Apache Struts S2-045 (CVE-2017-5638) → Equifax-style breach" attack path?
Crafted Content-Type header is parsed as OGNL — execute commands as the app user. The 2017 Equifax breach origin: unpatched Struts endpoint exposed to the internet. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bulk customer PII exfil (T1041) — a exfiltration primitive. Assumed environment: target runs a Java app on Apache Struts 2.
What is the final impact of this kill-chain?
The final step lands on Send malicious Content-Type → OGNL eval (CVE-STRUTS-S2-045), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers