Homepage
About Snyk

Arbitrary Code Execution Affecting org.apache.struts:struts2-core package, versions [,2.3.34) [2.4,2.5.12)

0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 97.3% (100th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHESTRUTS-31503
  • published 6 Sep 2017
  • disclosed 5 Sep 2017
  • credit Lupin, David Greene, Roland McIntosh
Report a new vulnerability Found a mistake?

Introduced: 5 Sep 2017

CVE-2017-12611 Open this link in a new tab
CWE-20 Open this link in a new tab
CWE-502 Open this link in a new tab

How to fix?

Developers are strongly advised to upgrade their Apache Struts components to version 2.3.34, 2.5.12 or higher.

Overview

Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to arbitrary code execution. Using expression literals or forcing expressions in Freemarker tags (see example snippet below), and using request values can lead to remote code execution.

<@s.hidden name="redirectUri" value=redirectUri />
<@s.hidden name="redirectUri" value="${redirectUri}" />
<@s.hidden name="${redirectUri}"/>

In both cases a writable property is used in the value attribute and in both cases this is treated as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:

<@s.hidden name="redirectUri" value="%{redirectUri}" />
<@s.hidden name="%{redirectUri}"/>