MVC Framework Guidance
Characteristic Description
Entities with this label display content suggesting their web applications use an implementation of the model view controller (MVC) architecture. MVC frameworks like Apache Struts (https://struts.apache.org/) and Spring (https://spring.io/) have had widely publicized, high impact vulnerabilities that affected a range of applications built upon them. While specific framework and version could not be detected, expect attackers to use any reliable exploits in their possession based on their possibility of weakness.
Recommendation
Configure
Implement any security related configuration advice offered by vendors where possible. For in house developed applications, place more emphasis on following secure coding practices.
Other Options
Control
Web application firewalls are effective tools for mitigating attacks against MVC frameworks. The closer application security policies are to default deny the better insulated systems will be against new threats. Having the means to block new attack patterns in the future is a better capability to have than no protection at all.
Accept
In some cases, there will be no other option but to accept the presence of MVC frameworks, particularly on third party products running software outside of our direct control. Reviewing third party notices from vendors for MVC frameworks can provide more information. Having these cases documented ahead of the announcement of new attacks will make it easier to prioritize the systems for patches or isolation when necessary.