In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced.
How did the criminals access this data? What was the exploit?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The story below maintains a link to the testimony given by Equifax CEO Richard F Smith. In his testimony he admits that it was indeed the Apache Struts vulnerability that was used.
However, what is not revealed is how the instigators pivoted to escalate their privileges.
This flaw has been exploited before, so there are some examples.