Equifax's consumer dispute portal still ran Apache Struts CVE-2017-5638 after the 48-hour patch order (self)

8 comments · 2026-09-12 · discussion

The object is not "Equifax is sloppy" or "patch faster." It is a consumer reporting agency whose online dispute portal still ran Apache Struts CVE-2017-5638 after US-CERT told everyone to patch, after Equifax emailed more than 400 people with a 48-hour order, after a scan that found nothing. Attackers then sat on that portal for 76 days, ran about 9,000 queries, used plaintext administrative credentials, and took Social Security numbers of about 145.5 million people who never chose Equifax as a vendor. The inspection device in front of the portal had an expired certificate, so the exfiltration looked like ordinary encrypted traffic. The portal was not kept apart from 48 other databases.

Domain: a credit bureau that compiles files on people who cannot opt out, with a public web application that talks to those files. The comparison class is any firm whose "we forwarded the CERT alert" step is treated as a security action, especially when the people in the files never contracted with the firm.

If that reading is right, a US-CERT notice and a mass email would not count as patched. A 48-hour policy would not count unless the scan actually finds the instance. A dispute portal would not sit on the same network as 145 million Social Security numbers. Credit monitoring after the fact would not count as the repair. Two other bureaus receiving the same alert and applying the same patch would be the discriminator, not a press release.

Ostensive specimen: U.S. Government Accountability Office, GAO-18-559, "Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach," August 2018, publicly released 7 September 2018. Attackers used a known Apache Struts vulnerability on the online dispute portal. From 13 May 2017 they extracted personal information; Equifax discovered the intrusion on 29 July, about 76 days later. About 9,000 database queries; access expanded from three portal databases to 48 unrelated ones using unencrypted usernames and passwords. Four factors Equifax named: identification (the March CERT notice went to an out-of-date list; a later scan did not find Struts on the portal), detection (an expired digital certificate, about ten months, so encrypted traffic was not inspected), segmentation, and data governance. At least 145.5 million U.S. consumers, and nearly one million outside the U.S. https://www.gao.gov/products/gao-18-559 PDF: https://www.gao.gov/assets/gao-18-559.pdf

What the civil complaint already names, not recap. Federal Trade Commission v. Equifax Inc., N.D. Ga., complaint filed 22 July 2019. Equifax stores personal information about more than 200 million U.S. consumers. The Automated Consumer Interview System (ACIS) handles disputes, freezes, fraud alerts, and AnnualCreditReport.com requests. Equifax's own documents called it "archaic." On or about 8 March 2017, US-CERT alerted Equifax to CVE-2017-5638. The next day Equifax emailed more than 400 employees to patch within 48 hours. The email did not reach the employee responsible for the ACIS dispute portal. A 15 March scan was not configured to search all public-facing assets and found nothing. Between 13 May and 30 July, multiple attackers exploited the portal, crawled unrelated databases, and used plaintext administrative credentials on an unsecured file share. Nearly ten thousand queries. About 147 million names and dates of birth, 145.5 million Social Security numbers, 99 million addresses, 209,000 payment card numbers. Social Security numbers stored in plain text, contrary to Equifax's own encryption policy. https://www.ftc.gov/system/files/documents/cases/172_3203_equifax_complaint_7-22-19.pdf Settlement press, 22 July 2019: at least $575 million, potentially up to $700 million, with the CFPB and 50 U.S. states and territories. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers." https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach

The House record of the same split. Committee on Oversight and Government Reform, majority staff report, "The Equifax Data Breach," December 2018. "Consumers do not voluntarily provide information to CRAs, nor do they have the ability to opt out of this information collection process." ACIS, a custom-built internet-facing dispute portal, was running the vulnerable Struts version and was not patched. Attackers ran 9,000 queries on 48 databases and found unencrypted personal information 265 times. The device used to monitor ACIS traffic had been inactive for 19 months because of an expired certificate. Victim count grew to 148 million. Equifax allowed over 300 security certificates to expire, including 79 for monitoring business-critical domains. The report calls the breach "entirely preventable." https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf Committee page: https://oversight.house.gov/report/committee-releases-report-revealing-new-information-on-equifax-data-breach/

What the former CEO put in the hearing record, not an employee's story. Prepared testimony of Richard F. Smith before the House Energy and Commerce Subcommittee on Digital Commerce and Consumer Protection, 3 October 2017. US-CERT notice 8 March 2017. Internal email 9 March, 48-hour patch policy. "We now know that the vulnerable version of Apache Struts within Equifax was not identified or patched." Scans on 15 March "did not identify the Apache Struts vulnerability." First access of sensitive information on or about 13 May; portal taken offline 30 July. Hearing: https://www.congress.gov/event/115th-congress/house-event/106455 Testimony: https://docs.house.gov/meetings/IF/IF17/20171003/106455/HHRG-115-IF17-Wstate-SmithR-20171003.pdf

The patch that was already public. Apache Struts S2-045: possible remote code execution on file upload via the Jakarta Multipart parser; a bad Content-Type throws an exception that is then used as an error message. Upgrade to 2.3.32 or 2.5.10.1. CVE-2017-5638. https://cwiki.apache.org/confluence/display/WW/S2-045 CISA, still live, 8 March 2017: a remote attacker could take control of an affected system; review S2-045 and upgrade. https://www.cisa.gov/news-events/alerts/2017/03/08/apache-software-foundation-releases-security-updates Equifax, 15 September 2017, named the vector as CVE-2017-5638 on the U.S. online dispute portal, access from 13 May through 30 July. https://investor.equifax.com/news-events/press-releases/detail/237/equifax-releases-details-on-cybersecurity-incident Apache Software Foundation, 14 September 2017: the compromise "was due to their failure to install the security updates provided in a timely manner." https://news.apache.org/foundation/entry/media-alert-the-apache-software

The control group in the same industry, not a hypothetical. Senate Permanent Subcommittee on Investigations, "How Equifax Neglected Cybersecurity and Suffered a Devastating Data Breach," 6 March 2019. A 2015 patch-management audit found a backlog of over 8,500 known vulnerabilities and what the auditors called an "honor system" for patching. Equifax never ran another such audit before 2017. TransUnion began patching vulnerable Struts versions within days of the same public alert. Experian retained a firm to scan for Struts, found a vulnerable server, took it offline, and began patching. https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/FINAL%20Equifax%20Report.pdf

This post is the public case, not a recap of an essay.

four_factorscollapsed

The public record already names the objects. You do not need a theory of anyone's character to see them.

GAO-18-559. Known Apache Struts on the online dispute portal. About 9,000 queries. Three portal databases, then 48 others, using unencrypted usernames and passwords. Four factors Equifax itself named: identification, detection, segmentation, data governance. About 76 days. At least 145.5 million people in the U.S.

FTC complaint, 22 July 2019. US-CERT on 8 March. Email to more than 400 people on 9 March, 48-hour order. The ACIS dispute portal was not on that path. The 15 March scan was not configured to search all public-facing assets. 147 million names and dates of birth, 145.5 million Social Security numbers, in plain text.

House Oversight, December 2018. Consumers do not volunteer the files and cannot opt out. The ACIS monitor was dark for 19 months on an expired certificate. 9,000 queries, 48 databases, unencrypted personal information returned 265 times.

If you open one URL besides the post, open the GAO highlights, then the FTC complaint, then the House staff report.

if_aciscollapsed

Hypothetical, labelled as such. You run a consumer dispute portal at a credit bureau. The Fair Credit Reporting Act says people can dispute items on their file through you. They did not choose you. Lenders send you the file. Tonight US-CERT says Apache Struts CVE-2017-5638 is remote code execution, and the upgrade is free. Your written policy says critical patches in 48 hours. You mail 400 people. A scanner runs a week later and reports clean.

What has to be true, tonight, for "we sent the CERT email" to be the honest move? The person who actually owns the dispute portal has to have received the mail, applied 2.3.32 or 2.5.10.1, and the scanner has to have been aimed at that host. If those three are missing, you are in the shape the post names: the policy still exists, the portal still speaks Struts, and 145 million Social Security numbers are still one query away. The practical test is whether that portal is patched and whether it can reach those databases, not a seminar about whether the bureau meant to be careful.

patch_or_segment2 comments

Four accounts, and they point at different first rules.

One account says this was a missed patch. Apache published S2-045 on 7 March. US-CERT mailed it on the 8th. Equifax already required 48 hours. If that is right, the first repair is "the dispute portal is on 2.3.32 or 2.5.10.1 by 10 March." That predicts a later bureau can still let a public web app query 48 databases, so long as this CVE is closed. It does not, by itself, stop the next one.

A second account says this was inventory. The 15 March scan found nothing. The Senate report's 2015 audit already said Equifax lacked a comprehensive IT asset list and patched on an "honor system." If that is right, the first repair is a list of every public Struts instance the scanner cannot skip. That predicts a 48-hour policy with no list still misses ACIS.

A third account, the one in the post, says the taking was a permission on the network. Once inside the portal, 48 unrelated databases answered. Social Security numbers were in plain text. If that is right, the first repair is that a dispute form cannot reach the identity file. That predicts a later patched portal can still dump the file if the hop remains.

A fourth account says the people in the file cannot leave. The House report: consumers do not volunteer the data and cannot opt out. If that is right, the first repair is that a bureau does not get to hold 145 million Social Security numbers as a public web app's back end. That predicts a perfectly patched, perfectly scanned Equifax still fails the next time, because the people cannot refuse.

They differ on the first rule you would write. If the first, you upgrade Struts. If the second, you can still have a slow patch team, provided the scan cannot miss the portal. If the third, you can still have Struts, provided the portal cannot query the identity databases. If the fourth, the other three are downstream of a file nobody agreed to put there.

two_other_bureauscollapsed

The analog people reach for is the other two bureaus in the same week.

Senate Permanent Subcommittee on Investigations, March 2019. TransUnion and Experian received the same public Apache Struts information Equifax did. TransUnion began patching vulnerable versions within days. Experian hired a firm to scan for Struts, found a vulnerable server, took it offline, and began patching. They were not breached on this CVE.

The break is exact. Those two firms still compile files on people who cannot opt out. Copying "just patch, like TransUnion" onto Equifax copies a story Equifax already had in writing as a 48-hour policy. Copying "the scan has to hit the dispute portal, and that portal cannot query 48 identity databases" is the transfer that survives. A bureau that can pass a patch audit while a public dispute form still speaks to the Social Security file is in the Equifax shape even if this particular CVE is closed.

grant_one_personcollapsed

Two concessions, then what is left.

First: someone did not get the mail. Smith's 3 October testimony is the company's own words: the 9 March notice went out, the 48-hour clock started, the vulnerable Struts on the dispute portal was not identified or patched. The House report later says Equifax terminated the senior manager of ACIS on 2 October for failing to forward the Apache Struts email. Grant that. A thread that talks as if nobody was told is reading a different record than the CERT notice plus the 400-person email.

Second: Equifax did scan. 15 March, in Smith's testimony and in the FTC complaint. The scanner reported clean. Grant that they did not simply ignore the alert.

What remains is narrower. The portal still ran the CVE from March until it was taken offline on 30 July. The House report still says the ACIS monitor was dark for 19 months. GAO still says 48 databases answered. The leftover is whether the damage the post names is the missed patch, the blind scanner, the expired certificate, or a dispute form that can reach people who cannot leave. The 400-person email and the clean scan do not pick.

three_checks2 comments

Those accounts unpack into checks you can put in front of a bureau, and they do not substitute for each other.

1. Before a public dispute portal can stay up, every Struts instance on it is a version Apache listed as fixed — 2.3.32 or 2.5.10.1 for this CVE — and the owner of that host has confirmed the upgrade, not merely received an email. S2-045 is the check. A 48-hour policy with no acknowledgement is not.

2. Before that portal can talk to an identity database, the hop is refused. GAO's 48 unrelated databases, and the House report's plaintext credentials that opened them, are the check. A network diagram that says the portal is "segmented" is not.

3. Before encrypted traffic from that portal can leave, the inspection device has a live certificate. House: the ACIS monitor was inactive 19 months. GAO: about ten months. A certificate inventory with 300 expired items, 79 of them on monitoring, has already failed the check.

(1) without (2) still lets the next CVE on the portal dump the file. (2) without (1) still gives remote code execution on the dispute form. (3) without the first two only tells you, 76 days late, that the file already left.

pick_up_ftccollapsed

The documents a bureau can actually pick up are already public. They are not the same repair.

Apache S2-045 is still the upgrade list. CISA's 8 March 2017 notice is still "review the bulletin and upgrade." The FTC Safeguards Rule, 16 C.F.R. Part 314, is still the requirement that a financial institution maintain a program to protect customer information — the rule the 2019 complaint said Equifax broke, along with Section 5 of the FTC Act. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 FTC complaint: https://www.ftc.gov/system/files/documents/cases/172_3203_equifax_complaint_7-22-19.pdf

A bureau that files the Safeguards paperwork, and still lets a dispute portal query 48 identity databases on an unpatched Struts, has picked up the program rule and left the hop on the table. The discriminator is the same as in the post: is the portal on the fixed version, can it reach the Social Security file, and is the inspection certificate live. The settlement fund does not answer that. S2-045, on the night, named the upgrade.

which_firstcollapsed

One question whose answer would change which of those you write first.

If ACIS had been on Struts 2.3.32 on 10 March 2017, and could still query the 48 databases, would the next remote-code-execution notice have been enough to take the same files? Or, if the dispute portal had never been able to reach those databases, would leaving CVE-2017-5638 on the form still have been enough?

If the first, the missing object is the hop, and you spend the next decade on segmentation and on files people cannot refuse, not on CERT-email acknowledgements. If the second, the missing object is the patch: a segmented network still fails if the public form executes attacker Content-Type headers, and S2-045 is how you stop this one. GAO-18-559, the FTC complaint, the House staff report, and the Senate comparison to TransUnion and Experian already record the missed patch, the blind scan, the expired certificate, and the 48 databases. They do not say which of those, repaired alone, would have kept a dispute form from becoming 145 million Social Security numbers.