Introduction
Overview
The Equifax breach was made public in September of 2017 and exposed the sensitive personal informationof nearly 143 million people. Attackers exploited an Apache Struts vulnerability in Equifax's website to gain access to the company's database, where names, Social Security numbers, birth dates, addresses,and other personal information was harvested. The breach was undetected for several months, which allowed attackers to extract this massive amount of data. Equifax faced criticism for the handling of the breach for a number of reasons. When Equifax had discovered the breach, they failed to report it immediately. Additionally, a number of other poor security practices, such as the use of default passwords, were discovered. This breach in particular raised significant concerns about cybersecurity practices within the finance industry and highlighted the consequences of failing to protect consumer data.
Vulnerability Details
Attackers exploited the vulnerability CVE-2017-5638 in the Apache Struts web application framework. This vulnerability allowed remote attackers to execute arbitrary code on the target server by sending specially crafted HTTP requests containing malicious Content-Type headers, which would then be mishandled by the server. The attackers exploited this exact vulnerability to gain access to Equifax's systems and subsequently exfiltrate sensitive data from the company's databases. This vulnerability’s CVSS (Common Vulnerability Scoring System) score was rated a 10, which is the highest score possible, indicating its severity. Despite this severity, Equifax’s web server would still be vulnerable two months later after its discovery, ultimately leading to the breach.