Cyberpediaby Brain
ENDEFR

Equifax breach autopsy 2017

The March 2017 Apache Struts flaw (CVE-2017-5638): how an exposed server with an outdated component can be taken over, and what an employee does.

In 30 seconds

Where it happens
On a server or an application reachable from the Internet, for example a website, with a component that is not up to date.
What the attacker wants
To run commands remotely, then keep access and take data out.
The reflex
Report any abnormal behavior of a company website or tool to the IT department without delay, without trying to diagnose it yourself.
If it has already happened
Tell the security team, who will decide whether the application concerned must be isolated.

What it is

A web server open to the Internet and a piece of software that has not received its update: this situation exposes a network to intrusion. This article follows the Apache Struts flaw CVE-2017-5638, made public in March 20171, and compares it with a more recent case, Log4Shell.

A note on the sources: the reference file for this article describes the flaw, how it is exploited and good practice, but does not document the details of the intrusion at Equifax (duration, volume of data, monitoring). These elements are therefore not included here.

Straight answers

What was the March 2017 flaw?

An Apache Struts vulnerability allowed an attacker to cause remote execution of arbitrary code1. Versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 were affected1. Apache published bulletin S2-045 on 6 March 2017 to provide a fix1.

Did you have to be an expert to exploit it?

No. The CERT-FR noted «le faible niveau de technicité nécessaire à l'exploitation de cette vulnérabilité» (the low level of technical skill needed to exploit this vulnerability) and recommended deploying the fix as soon as possible1. The flaw had been actively exploited since the bulletin was published1.

Can an employee do anything?

An employee does not apply fixes, but sometimes sees the first sign: a page that responds poorly, a tool that behaves differently. The British NCSC starts from the principle that updates are a "business as usual" control7.

What should be done with a vulnerable application that holds sensitive data?

The CERT-FR judged that it should be disabled until the update was applied: it wrote that this was «fortement conseillé» (strongly advised)1.

1Inside the attacker's head1 min

The attacker looks for a door that is already open. MITRE describes this technique: exploiting a weakness in an Internet-facing system to gain initial access to a network. The weakness can be a software flaw, a temporary glitch or a configuration error2. The applications exploited are often websites and web servers2.

For the Struts flaw, the CERT-FR speaks of a «faible niveau de technicité» (low level of technical skill) needed for exploitation1. The sources do not describe the exact format of the attack and this article does not invent it.

Next, the attacker settles in. MITRE describes the web shell: a script placed on an accessible web server, which serves as a gateway into the network and can offer execution functions or a command line on the machine that hosts the server3. The goal is lasting access (the "Persistence" tactic at MITRE)3.

Finally, the attacker takes the data out. MITRE describes exfiltration over the command-and-control channel already established: the stolen data is encoded in the normal communication flow, using the same protocol4.

2What you see on screen1 min

The screen may show nothing abnormal. Small details are then worth reporting: unusual slowness, a modified page, a service that restarts for no reason, an alert from a security tool.

These signs prove nothing on their own. The employee does not have to settle the question: they describe what they saw (time, application, behavior) and let the security team conclude.

3Under the hoodIT teams1 min

The mechanism comes down to four steps, each backed by the sources.

  • The flaw: a defect in a component (here Struts) that the Apache fix corrects1.
  • The entry: exploitation of an application exposed to the Internet, which allows remote code execution12.
  • The installation: a web shell or another lasting access3.
  • The exit: the data leaves the network over the command-and-control channel4.

On the defense side, MITRE lists measures against the exploitation of an exposed application. Update exposed software regularly. Scan exposed systems regularly and plan procedures for rapid fixes when a critical flaw is discovered. Segment exposed servers from the rest of the network. Restrict outbound traffic from public servers: this does not prevent the initial exploitation, but the attacker has more difficulty controlling the compromised server afterwards2.

The NCSC recalls a basic point: all systems contain vulnerabilities, and effective management makes it possible to know which ones are present and where updates fail7.

4Case filesReal cases1 min

Apache Struts, March 2017

On 6 March 2017, Apache publishes bulletin S2-0451. On 10 March 2017, the CERT-FR issues its alert, which states that the flaw has been actively exploited since publication1. The alert is closed on 10 May 20171. At the date of its alert, four days after the bulletin, the CERT-FR therefore observes active exploitation of the flaw1.

Log4Shell, December 2021

The CERT-FR publishes its first alert on Log4j on 10 December 20215. The library is very often used in Java projects and by off-the-shelf software vendors5. An attacker can cause remote code execution without being authenticated, for example through a login page that logs errors5.

According to public information relayed by the joint advisory from CISA and its partners, exploitation of Log4Shell began on or around 1 December 2021, and public exploit code exists6. The FBI observed exploitation attempts and mass scans aimed at installing cryptocurrency mining software and botnet software6. The advisory first asks for the affected assets to be identified: take an inventory of all assets that use the Log4j library, cloud included6.

Fact sheet

Identifier
CP-181
Wing
2. Malware and case files
Brain skill
Incident Reporting & Response (report_incidents)
Brain reflex
cr-031
Diagram
G4 · Incident Timeline & Containment
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. CERT-FR (ANSSI), “Vulnérabilité dans Apache Struts”, 10 March 2017. https://cert.cyber.gouv.fr/alerte/CERTFR-2017-ALE-004/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Exploit Public-Facing Application”. https://attack.mitre.org/techniques/T1190/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Server Software Component: Web Shell”. https://attack.mitre.org/techniques/T1505/003/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Exfiltration Over C2 Channel”. https://attack.mitre.org/techniques/T1041/ (accessed 3 November 2026)
  5. CERT-FR (ANSSI), “[MaJ] Vulnérabilité dans Apache Log4j”, 10 December 2021. https://cert.cyber.gouv.fr/alerte/CERTFR-2021-ALE-022/ (accessed 3 November 2026)
  6. CISA, “Mitigating Log4Shell and Other Log4j-Related Vulnerabilities”. https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a (accessed 3 November 2026)
  7. NCSC (UK), “Vulnerability management”, 12 February 2024. https://www.ncsc.gov.uk/collection/vulnerability-management (accessed 3 November 2026)

Cite this article

Brain, “Equifax breach autopsy 2017”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/

BibTeX 
@misc{brain_cp181_en_2026,
  author = {Brain},
  title = {Equifax breach autopsy 2017},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/equifax-breach-struts-autopsy/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence