KRAMPUS DELIVERS AN END-OF-YEAR STRUTS VULNERABILITY

Summary from the TLDR InfoSec newsletter

NIST updated CVE-2023-50164 for a new path traversal vulnerability in struts-core. It is reminiscent of the 2017 Equifax breach stemming from an unpatched Struts issue. This post discusses the vulnerability, provides a proof-of-concept exploit, and outlines remediation steps.