--- id: CP-181 slug: equifax-breach-struts-autopsy lang: en title: Equifax breach autopsy 2017 description: "The March 2017 Apache Struts flaw (CVE-2017-5638): how an exposed server with an outdated component can be taken over, and what an employee does." canonical_url: https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/ markdown_url: https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Equifax breach autopsy 2017", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/ (CC BY 4.0) wing: 2 theme: report_incidents reflex: cr-031 schema: G4 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/ fr: https://startbrain.io/cyberpedia/fr/articles/autopsie-equifax-struts/ de: https://startbrain.io/cyberpedia/de/articles/equifax-struts-analyse/ es: https://startbrain.io/cyberpedia/es/articles/autopsia-equifax-struts/ sources: - "n": 1 title: Vulnérabilité dans Apache Struts publisher: CERT-FR (ANSSI) url: https://cert.cyber.gouv.fr/alerte/CERTFR-2017-ALE-004/ published: "2017-03-10" accessed: "2026-11-03" - "n": 2 title: Exploit Public-Facing Application publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1190/ accessed: "2026-11-03" - "n": 3 title: "Server Software Component: Web Shell" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1505/003/ accessed: "2026-11-03" - "n": 4 title: Exfiltration Over C2 Channel publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1041/ accessed: "2026-11-03" - "n": 5 title: "[MaJ] Vulnérabilité dans Apache Log4j" publisher: CERT-FR (ANSSI) url: https://cert.cyber.gouv.fr/alerte/CERTFR-2021-ALE-022/ published: "2021-12-10" accessed: "2026-11-03" - "n": 6 title: Mitigating Log4Shell and Other Log4j-Related Vulnerabilities publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a accessed: "2026-11-03" - "n": 7 title: Vulnerability management publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/vulnerability-management published: "2024-02-12" accessed: "2026-11-03" --- # Equifax breach autopsy 2017 A web server open to the Internet and a piece of software that has not received its update: this situation exposes a network to intrusion. This article follows the Apache Struts flaw CVE-2017-5638, made public in March 2017 [1], and compares it with a more recent case, Log4Shell. A note on the sources: the reference file for this article describes the flaw, how it is exploited and good practice, but does not document the details of the intrusion at Equifax (duration, volume of data, monitoring). These elements are therefore not included here. ## In 30 seconds - Where it happens: on a server or an application reachable from the Internet, for example a website, with a component that is not up to date. - What the attacker wants: to run commands remotely, then keep access and take data out. - The reflex: report any abnormal behavior of a company website or tool to the IT department without delay, without trying to diagnose it yourself. - If it has already happened: tell the security team, who will decide whether the application concerned must be isolated. ## Straight answers ### What was the March 2017 flaw? An Apache Struts vulnerability allowed an attacker to cause remote execution of arbitrary code [1]. Versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 were affected [1]. Apache published bulletin S2-045 on 6 March 2017 to provide a fix [1]. ### Did you have to be an expert to exploit it? No. The CERT-FR noted «le faible niveau de technicité nécessaire à l'exploitation de cette vulnérabilité» (the low level of technical skill needed to exploit this vulnerability) and recommended deploying the fix as soon as possible [1]. The flaw had been actively exploited since the bulletin was published [1]. ### Can an employee do anything? An employee does not apply fixes, but sometimes sees the first sign: a page that responds poorly, a tool that behaves differently. The British NCSC starts from the principle that updates are a "business as usual" control [7]. ### What should be done with a vulnerable application that holds sensitive data? The CERT-FR judged that it should be disabled until the update was applied: it wrote that this was «fortement conseillé» (strongly advised) [1]. ## Inside the attacker's head The attacker looks for a door that is already open. MITRE describes this technique: exploiting a weakness in an Internet-facing system to gain initial access to a network. The weakness can be a software flaw, a temporary glitch or a configuration error [2]. The applications exploited are often websites and web servers [2]. For the Struts flaw, the CERT-FR speaks of a «faible niveau de technicité» (low level of technical skill) needed for exploitation [1]. The sources do not describe the exact format of the attack and this article does not invent it. Next, the attacker settles in. MITRE describes the web shell: a script placed on an accessible web server, which serves as a gateway into the network and can offer execution functions or a command line on the machine that hosts the server [3]. The goal is lasting access (the "Persistence" tactic at MITRE) [3]. Finally, the attacker takes the data out. MITRE describes exfiltration over the command-and-control channel already established: the stolen data is encoded in the normal communication flow, using the same protocol [4]. ## What you see on screen The screen may show nothing abnormal. Small details are then worth reporting: unusual slowness, a modified page, a service that restarts for no reason, an alert from a security tool. These signs prove nothing on their own. The employee does not have to settle the question: they describe what they saw (time, application, behavior) and let the security team conclude. ## Under the hood The mechanism comes down to four steps, each backed by the sources. - The flaw: a defect in a component (here Struts) that the Apache fix corrects [1]. - The entry: exploitation of an application exposed to the Internet, which allows remote code execution [1][2]. - The installation: a web shell or another lasting access [3]. - The exit: the data leaves the network over the command-and-control channel [4]. On the defense side, MITRE lists measures against the exploitation of an exposed application. Update exposed software regularly. Scan exposed systems regularly and plan procedures for rapid fixes when a critical flaw is discovered. Segment exposed servers from the rest of the network. Restrict outbound traffic from public servers: this does not prevent the initial exploitation, but the attacker has more difficulty controlling the compromised server afterwards [2]. The NCSC recalls a basic point: all systems contain vulnerabilities, and effective management makes it possible to know which ones are present and where updates fail [7]. ## Case files ### Apache Struts, March 2017 On 6 March 2017, Apache publishes bulletin S2-045 [1]. On 10 March 2017, the CERT-FR issues its alert, which states that the flaw has been actively exploited since publication [1]. The alert is closed on 10 May 2017 [1]. At the date of its alert, four days after the bulletin, the CERT-FR therefore observes active exploitation of the flaw [1]. ### Log4Shell, December 2021 The CERT-FR publishes its first alert on Log4j on 10 December 2021 [5]. The library is very often used in Java projects and by off-the-shelf software vendors [5]. An attacker can cause remote code execution without being authenticated, for example through a login page that logs errors [5]. According to public information relayed by the joint advisory from CISA and its partners, exploitation of Log4Shell began on or around 1 December 2021, and public exploit code exists [6]. The FBI observed exploitation attempts and mass scans aimed at installing cryptocurrency mining software and botnet software [6]. The advisory first asks for the affected assets to be identified: take an inventory of all assets that use the Log4j library, cloud included [6]. ## Sources 1. CERT-FR (ANSSI), "Vulnérabilité dans Apache Struts", 10 March 2017. https://cert.cyber.gouv.fr/alerte/CERTFR-2017-ALE-004/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Exploit Public-Facing Application". https://attack.mitre.org/techniques/T1190/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Server Software Component: Web Shell". https://attack.mitre.org/techniques/T1505/003/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Exfiltration Over C2 Channel". https://attack.mitre.org/techniques/T1041/ (accessed 3 November 2026) 5. CERT-FR (ANSSI), "[MaJ] Vulnérabilité dans Apache Log4j", 10 December 2021. https://cert.cyber.gouv.fr/alerte/CERTFR-2021-ALE-022/ (accessed 3 November 2026) 6. CISA, "Mitigating Log4Shell and Other Log4j-Related Vulnerabilities". https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a (accessed 3 November 2026) 7. NCSC (UK), "Vulnerability management", 12 February 2024. https://www.ncsc.gov.uk/collection/vulnerability-management (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.