# Apache struts exploit detection

**URL:** <https://community.zeek.org/t/apache-struts-exploit-detection/4725>\
**Category:** Zeek\
**Created:** [March 14, 2017, 6:56am UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725 "2017-03-14T06:56:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Edwards](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@John\_Edwards](https://community.zeek.org/u/John_Edwards)\
**Post date:** [March 14, 2017, 6:56am UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/1 "2017-03-14T06:56:31Z")

</div>

Hi all

For the likes of the apache struts web application attack that the actual exploit is contained within a web http GET request. Or let’s say any web app attack that is embedded within the referer field like embedded JavaScript can bro actually view or log that level of info?

I can see bro will see things like http user agent fields and get or post request but for the actual malicious code embedded further in the request I’m assuming isn’t captured?

My ips obviously captures that alert data and I can see the the exploit but the bro data from the http log I’ll only see “GET / HTTP1.1” and that’s all

Cheers  
John

---

<div class="post-metadata">

**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\
**Post date:** [March 14, 2017, 10:08am UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/2 "2017-03-14T10:08:02Z")

</div>

Here’s an example script that will detect CVE-2017-5638 exploit attempts and log the contents of the header.

[https://github.com/set-element/misc-scripts/blob/master/CVE-2017-5638\_struts.bro](https://github.com/set-element/misc-scripts/blob/master/CVE-2017-5638_struts.bro)

For future reference the key component is:

event http\_header(c: connection, is\_orig: bool, name: string, value: string) &priority=5

{

# look if the connection is from offsite and the value is content-type

if ( !Site::is\_local\_addr(c$id$orig\_h) && name == “CONTENT-TYPE” && detection\_string in value )

{

NOTICE([$note=HTTP\_StrutsAttack, $src=c$id$orig\_h, $msg=fmt(“CVE-2017-5638/Struts attack from %s seen: %s”, c$id$orig\_h, value)]);

}

}

Please note that this is not my script, it is set-element’s. Depending on the situation you may want to check the src/dst to add exemptions (vulnerability scanning boxes?), ignore or specifically monitor Site::is\_private\_addr src/dsts, add $identifier/$suppress\_for to the NOTICE, replace $src=… with $conn=c to get more details in the notice log, etc. All depends on what you want, those are just things I would do.

Jon

---

<div class="post-metadata">

**Author:** ![Drew\_Dixon](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Drew\_Dixon](https://community.zeek.org/u/Drew_Dixon)\
**Post date:** [March 14, 2017, 4:09pm UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/3 "2017-03-14T16:09:52Z")

</div>

Deploy this outstanding bro detection script for this vulnerability:

[https://github.com/initconf/CVE-2017-5638\_struts.git](https://github.com/initconf/CVE-2017-5638_struts.git)

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [March 14, 2017, 5:55pm UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/4 "2017-03-14T17:55:13Z")

</div>

And note that Aashish made it so you can install it using bro-pkg 🙂

Johanna

---

<div class="post-metadata">

**Author:** ![JonZeolla](https://avatars.discourse-cdn.com/v4/letter/j/ccd318/32.png) [@JonZeolla](https://community.zeek.org/u/JonZeolla)\
**Post date:** [March 23, 2017, 12:54pm UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/5 "2017-03-23T12:54:10Z")

</div>

I just wanted to add onto this thread and mention that it appears there is a new way to exploit CVE-2017-5638 which neither of the prior scripts are currently looking for. I’ve opened [#3](https://github.com/initconf/CVE-2017-5638_struts/issues/3) on Aashish’s repo to provide more details.

Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/apache-struts-exploit-detection/4725/6 "2022-05-06T15:44:44Z")

</div>