flawopen.com/보안 사고/Equifax / Apache Struts

Equifax: 배포된 지 두 달 된 패치 방치로 1억 4,700만 명의 신용 정보 유출

Critical — 147M records CWE-917: Expression Language Injection Breach May–July 2017, disclosed September 2017
쉬운 설명 (ELI5)

방문객이 자신의 언어를 말해야 하는 안내 데스크 인터폰이 있습니다. 그런데 방문객이 언어 대신 컴퓨터 프로그래밍 코드를 말하자, 안내 시스템이 오류를 내는 대신 명령을 그대로 수행하여 본관 금고 문을 전부 열어주었습니다.

Why the patch was never applied

The technical flaw is unremarkable; the organisational failure is the reason this breach is still taught. Congressional and regulatory findings identified a cluster of causes that compounded one another:

The lessons that actually transfer

Equifax is the canonical demonstration that vulnerability management is an inventory problem before it is a patching problem. The organisation knew about the CVE, had the patch, and issued the instruction — and still lost 147 million records, because the instruction could not be mapped onto a system nobody had recorded.

The second durable lesson is about monitoring integrity. A security control that has silently stopped working is worse than a missing one, because it produces false assurance. An expired certificate on an inspection appliance is a mundane operational defect that, in this case, cost 76 days of detection time.

FAQ

Was this a sophisticated attack?

The initial exploit was not. CVE-2017-5638 was public, widely weaponised, and being scanned for at internet scale within days of disclosure. What distinguished the incident was the length of undetected access and the breadth of data reachable once inside.

How fast do I actually need to patch?

For an internet-facing, unauthenticated RCE in a widely deployed framework, the practical window is days, not weeks — mass scanning typically begins within 24–72 hours of public disclosure. The prerequisite is knowing where the software runs, which is why inventory work pays off more than patch-speed targets alone.

Related reading

출처 및 공식 보안 권고