A security flaw in Java and Python could allow cybercriminals to bypass firewalls and put enterprise information at risk. The vulnerability has been referenced in two recent advisory notes from industry expert Alexander Klink and Blindspot security researcher Timothy Morgan. The security flaw was first identified in 2014 by Russian security lab ONsec in 2014, yet Bleeping Computer noted the issue did not receive the public attention it required at the time.

Researchers suggest vendors need to patch the bug. They also advised enterprise IT managers and the public to take steps to ensure the risk of exposure is minimized.

How Does the Security Flaw Work?

The security flaw in Java and Python allows an attacker to bypass firewalls and inject malicious commands into file transfer protocol (FTP) URLs. The vulnerability exists due to the way Java and Python handle those FTP links, according to ZDNet.

Klink explained on his blog how Java’s XML External Entity (XEE) does not verify the syntax of usernames in its FTP protocol. He demonstrated the process by sending an SMTP email in an FTP connection attempt.

Morgan subsequently detailed how the same exploit can allow attackers to bypass firewalls through a multistage process. The bug fools the firewall into permitting connections on its high ports between 1024 and 65535.

How Is the Industry Reacting?

An older issue in classic FTP lies at the heart of the injection attacks, Bleeping Computer reported. Classic mode has been replaced by passive mode FTP, which provides more secure client-server interactions.

The bad news is that most firewall products still support classic mode FTP connections. Attackers can inject malicious commands and use the whitelisted classic FTP connection to access computers.

Morgan said in his advisory note that the Python security team was notified of the security flaw in January 2016 and there has, as yet, been no action taken. Oracle was notified in early November 2016, but no patch for Java is currently available.

What Should Senior Executives Do Now?

The news reinforces fears over the insecurity of some element of web applications. Recently released research from Contrast Security suggested injection flaws are still quite common in Java, affecting 38 percent of applications. The research also found that 80 percent of tested web applications have at least one vulnerability.

Morgan advised users to consider uninstalling Java from all desktop systems. Where legacy requirements make this task difficult, he suggested disabling the Java plugin from all browsers instead. Additionally, network administrators should consider disabling classic mode FTP in all firewalls and only allow passive mode.

Senior technology managers should also pay close attention to vendor activities. Morgan said IT executives can ask both Oracle and the Python Software Foundation to work on a fix. New patches often come online, so technology bosses must ensure security updates are applied to all versions of Java and Python, such as those running on application servers and appliances.

More from

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…