org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via manipulation of file upload parameters that enable path traversal. Under certain conditions, uploading of a malicious file is possible, which may then be executed on the server.

Upgrade org.apache.struts:struts2-core to version 2.5.33, 6.3.0.2 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Denial of Service when certain fields exceed the maxStringLength limit during multipart requests. An attacker can exploit this to leave uploaded files in the struts.multipart.saveDir even after the request has been denied resulting in excessive disk usage.

Upgrade org.apache.struts:struts2-core to version 2.5.32, 6.1.2.2, 6.3.0.1 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of getProperty() by the XWorkListPropertyAccessor class. Exploiting this vulnerability is possible if the developer has set CreateIfNull to true for the underlying Collection type field.

Upgrade org.apache.struts:struts2-core to version 2.5.31, 6.1.2.1 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). The fix issued for CVE-2020-17530 was incomplete. Some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Upgrade org.apache.struts:struts2-core to version 2.5.30 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). The vulnerability exists due to improper input validation when processing certain tag's attributes. The application performs double evaluation of the code if a developer applied forced OGNL evaluation by using the %{...} syntax. A remote attacker can send a specially crafted request to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Upgrade org.apache.struts:struts2-core to version 2.5.26 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type. A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

Upgrade org.apache.struts:struts2-core to version 2.5 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Denial of Service (DoS). When a file upload is performed to an Action that exposes the file with a getter, an attacker may manipulate the request such that the working copy of the uploaded file is set to read-only. As a result, subsequent actions on the file will fail with an error. It might also be possible to set the Servlet container's temp directory to read-only, such that subsequent upload actions will fail.

Upgrade org.apache.struts:struts2-core to version 2.5.22 or higher.

org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

Upgrade org.apache.struts:struts2-core to version 2.5.22 or higher.

Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Denial of Service (DoS). The REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

Upgrade org.apache.struts:struts2-core to version 2.5.14.1 or higher.

Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to arbitrary code execution. Using expression literals or forcing expressions in Freemarker tags (see example snippet below), and using request values can lead to remote code execution.

<@s.hidden name="redirectUri" value=redirectUri />
<@s.hidden name="redirectUri" value="${redirectUri}" />
<@s.hidden name="${redirectUri}"/>

In both cases a writable property is used in the value attribute and in both cases this is treated as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:

<@s.hidden name="redirectUri" value="%{redirectUri}" />
<@s.hidden name="%{redirectUri}"/>

Developers are strongly advised to upgrade their Apache Struts components to version 2.3.34, 2.5.12 or higher.

Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.

The REST Plugin in affected versions use a XStreamHandler with an instance of XStream for deserialization without any type filtering. By design, there are few limits to the type of objects XStream can handle. This flexibility comes at a price. The XML generated or consumed by XStream includes all information required to build Java objects of almost any type. The provided XML data is used by XStream to unmarshal Java objects. An attacker could use this flaw to execute arbitrary code or conduct further attacks.

A working exploit is publicly available and is actively exploited in the wild.

You can read more about this vulnerability on our blog.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

• Apache Blog

Developers are strongly advised to upgrade their Apache Struts components to version 2.3.34, 2.5.13 or higher.

It is possible that some REST actions stop working because of applied default restrictions on available classes. In this case please investigate the new interfaces that were introduced to allow class restrictions per action, those interfaces are:

• org.apache.struts2.rest.handler.AllowedClasses
• org.apache.struts2.rest.handler.AllowedClassNames
• org.apache.struts2.rest.handler.XStreamPermissionProvider

If for some reason upgrading is not an option, consider the following workarounds:

1. Disable handling XML pages and requests to such pages

<constant name="struts.action.extension" value="xhtml,,json" />

2. Override getContentType in XStreamHandler

 public class MyXStreamHandler extends XStreamHandler { 
   public String getContentType() {
     return "not-existing-content-type-@;/&%$#@";
   }
 }

3. Register the handler by overriding the one provided by the framework in your struts.xml

<bean type="org.apache.struts2.rest.handler.ContentTypeHandler" name="myXStreamHandmer" class="com.company.MyXStreamHandler"/>
<constant name="struts.rest.handlerOverride.xml" value="myXStreamHandler"/>