Supply Chain Attacks: A Java Dependency Nightmare that Became a Reality

Joao Correia

August 28, 2023 - Technical Evangelist

The digital world thrives on interconnectedness, and nowhere is this more apparent than in the vast web of dependencies that form the backbone of modern software development. While dependencies are an essential part of modern software design, they can also serve as a critical vulnerability. In this post, we will explore a real-world example of how Java dependencies led to a significant security problem.

The Event: A Java Library Becomes the Weak Link

The story begins with a widely-used Java library that served as a common dependency for various projects. This seemingly innocuous library became the target of a sophisticated supply chain attack.

In 2017, the incident involving Apache Struts, a popular open-source framework for developing Java-based web applications, highlighted the risks associated with dependencies in a software’s supply chain. A vulnerability in Apache Struts (CVE-2017-5638) allowed attackers to execute arbitrary code on servers running an affected version of the library.

How Did It Happen?

A perfect storm is a combination of multiple factors, rather than a single very critical event. This vulnerability showcases just how this happened, in a 1-2-3 punch that wouldn’t be out of place in a boxing arena.

Intrusion through the Dependency: Apache Struts was integrated as a dependency in thousands of commercial and private applications. When a vulnerability in the library was discovered, it allowed an attacker to gain control over any system running a vulnerable version.

Spread of the Attack: The broad usage of Apache Struts meant that a large number of systems were exposed to this vulnerability. As a result, the risk was compounded across a wide range of industries and applications.

Delayed Response: The complexity of identifying and updating a vulnerable dependency across numerous systems led to delays in mitigation. These delays gave attackers ample time to exploit the vulnerability.

The Equifax Breach: A Real-World Consequence

One of the most significant real-world consequences of this vulnerability was the Equifax breach, where attackers exploited the Apache Struts vulnerability to gain access to sensitive data for approximately 143 million individuals. This breach had far-reaching implications, affecting not only Equifax but also the countless people whose information was exposed.

Lessons Learned and Mitigation Strategies

The Apache Struts incident serves as a cautionary tale, reminding us that supply chain risks can have real-world consequences. Here’s what can be done to minimize such risks:

Regular Scanning for Vulnerabilities: Regularly scanning dependencies for known vulnerabilities and updating them promptly can help in early detection.

Adopt a Least Privilege Model: Limiting permissions of dependencies can prevent them from becoming a gateway to the entire system.

Monitoring Dependencies: Utilize tools that provide visibility into the dependencies being used and their associated risks.

Ensure Strong Governance: Implement strict controls over the usage of third-party libraries and maintain an up-to-date inventory of all dependencies.

Find a Trusted Partner: Team up with the right organization to maintain and test the dependencies you pull into your project.

By relying upon a solid foundation, your project will always have someone keeping an eye out for emerging vulnerabilities and providing up-to-date libraries you can confidently pull and update from. This is made easy with SecureChain for Java.

Final Thoughts

The Apache Struts incident sheds light on the risks and challenges of managing a large number of dependencies in software development, particularly in widely-used languages like Java. As we move forward in an increasingly interconnected digital landscape, the need for vigilance in monitoring and managing dependencies has never been more apparent. By understanding and implementing proper risk management strategies, we can reduce the likelihood of a devastating supply chain attack in the future.

Summary