Organisations often choose Java for their applications due to its platform independence, robustness, scalability, and extensive ecosystem of libraries and frameworks. This widespread usage makes it an attractive target for attackers, and vulnerabilities often arise due to its complexity and the challenge of ensuring timely updates across diverse environments, leaving vulnerabilities unpatched.
This is vividly illustrated through several high-profile breaches. These incidents underscore the critical need for rigorous patch management and vigilant security protocols, especially for systems reliant on older technologies. Let’s delve into some significant breaches, their impact on legacy systems, and the lessons learned.
The Equifax Breach: A Failure to Patch
In 2017, Equifax, one of the largest credit agencies in the U.S., suffered a massive data breach that exposed the personal information of approximately 143 million Americans. This breach was primarily due to the exploitation of a known vulnerability in the Apache Struts framework, identified as CVE-2017-5638. A patch for this vulnerability had been available since March, several months before the breach occurred in May. The delay in applying this patch was not just a matter of downloading and installing it; it required each web application developed with the vulnerable version of Apache Struts to be recompiled with the patched version. This complex requirement contributed significantly to the delay in patching the vulnerable systems. The gap between the patch becoming available and then being deployed is often referred to as the patch gap. This gap can be difficult for organisations to close as it would require extensive documentation, testing and then deployment. This can often take several months leaving the organisation exposed.
The Log4j Vulnerability: Rapid Response to a Widespread Threat
The Log4j vulnerability, disclosed in December 2021, affected countless applications worldwide due to its presence in the popular Java logging library. Fixes for this critical vulnerability were released on December 6, 2021, three days before the vulnerability was widely published. The initial fix included measures to restrict the servers and protocols that could be used for lookups, addressing the remote code execution risk. Subsequent updates resolved additional vulnerabilities, including a denial-of-service attack and another remote code execution vulnerability under certain conditions. These rapid updates were crucial in mitigating the impact, highlighting the importance of a swift response to newly discovered vulnerabilities. For many organisations though it was difficult to patch as they often weren’t aware of the usage of log4j in applications they were utilising and would only become aware of it via extensive vulnerability scans. This then creates the challenge of having to identify each vulnerable application, contact the developer and then hope there is a software update available.
Oracle WebLogic Server: Recurring Vulnerabilities
Oracle WebLogic Server has frequently been the target of vulnerabilities that allow remote code execution, particularly troubling for enterprise environments using older versions of this Java EE server. These vulnerabilities often arise from deserialization issues and other exploits that attackers can use to gain unauthorised access. The recurrence of these vulnerabilities in WebLogic highlights the ongoing risk associated with legacy Java applications and the necessity for continuous monitoring and immediate application of security patches.
Strategies for Mitigating Risk in Legacy Java Applications
Despite the challenges, there are several strategies to protect against and detect these vulnerabilities early.
Close the Patch Gap: Ensure that all security patches are applied as soon as they are available, particularly for known vulnerabilities that affect widely used components like Apache Struts or Log4j. Where you can’t patch quickly, virtual patching can provide coverage until you can or if you can’t patch.
Collect SBOM’s: Many developers provide Software Bill of Materials for their products. Having access to these can dramatically speed up your response by giving visibility to vulnerable packages and their versions.
Regular Vulnerability Scanning: Make sure you’re scanning regularly for vulnerabilities in your environment. Monthly scans are not frequent enough to identify new and evolving threats.
Enhanced Monitoring: Deploy advanced monitoring tools that can detect and alert on signs of exploitation attempts against vulnerable applications.
Education and Training: Keep development and security teams well-informed about the latest security threats and best practices for maintaining legacy applications.
Conclusion
The breaches and vulnerabilities discussed underscore the complex challenges and crucial importance of securing legacy Java applications. By learning from these incidents and implementing robust security measures, organisations can better protect their critical data and infrastructure from potential threats. Through diligent patch management, continuous monitoring, and proactive security practices, the risks associated with legacy Java applications can be significantly mitigated.
