Banks, insurance companies, and Fortune 500 corporations take note: attack code has just gone public for a hard-to-patch vulnerability that hackers can exploit to take control of your website.

The critical vulnerability is located in Apache Struts 2, an open-source framework that large numbers of enterprise-grade organizations use to develop customer-facing Web applications. The bug, which has been active since 2008, allows end users to execute malicious code or commands by plugging maliciously modified data into search boxes or similar features hosted on the site.

Apache Struts maintainers released a patch on Tuesday. Unfortunately, installing the update is only the first step. Vulnerable sites must then use the new version to rebuild vulnerable Web apps and thoroughly test them before deploying them in their production sites. The process can be labor and time intensive. What's more, the particular vulnerability this time may require developers to change the code that calls the Struts framework. Further complicating matters: many sites don't always have a complete list of apps running on their sites, which makes finding out if they're at risk harder.

In the meantime, code that exploits the vulnerability has been released through Metasploit, an open-source framework used by security professionals and hackers alike. Coming a day after the vulnerability was publicly disclosed, the release underscores the ease in developing exploit code. Malicious hackers may copy it verbatim or use it as a starting point to develop more refined attacks.

It took less than three days for attackers to actively exploit a similar Apache Struts security bug after it was patched in March. The attacks carried out a variety of malicious actions. In some cases, attackers stopped the firewall protecting a vulnerable server and then downloaded and installed "IRC bouncers." IRC bouncers allow the attackers to hide their real IP address during Internet chats, denial-of-service bots, and various other packages that conscript a server into a botnet. Eight days after the patch was released, the active exploits still hadn't let up

The vulnerability this time affects Web apps that use the Apache Struts REST communication plugin. It's caused by the way the framework deserializes user-supplied input. Attackers can exploit it by supplying maliciously formed XML data to vulnerable sites.

The bug was privately reported by security researchers with software analytics firm Semmle who discovered the vulnerability using their service lgtm.com. Lgtm.com continuously analyzes more than 50,000 open-source projects for security and code issues. The Apache Struts analysis is here. Semmle researchers have published more details here and here.

The best course of action for sites with apps that use earlier Apache Struts versions is to rebuild apps using version 2.5.13. In the shorter term, sites that use Apache Struts apps but don't require REST should remove the plugin to reduce the attack surface available to would-be attackers. Sites that use apps that require the Apache Struts REST plugin should turn off XML support, using this configuration setting. Researchers at security firm Sophos have additional advice here.