Arbitrary Code Execution Affecting org.apache.struts:struts2-core Open this link in a new tab package, versions [,2.3.34) [2.4,2.5.12)


0.0
critical
  • Exploit Maturity

    Mature

  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGAPACHESTRUTS-31503

  • published

    6 Sep 2017

  • disclosed

    5 Sep 2017

  • credit

    Lupin, David Greene, Roland McIntosh

Overview

Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.

Affected versions of this package are vulnerable to Arbitrary Code Execution. An unauthenticated attack may be able to exploit this When using expression literals or forcing expression in Freemarker tags (see example below) and using request values can lead to RCE attack.

<@s.hidden name="redirectUri" value=redirectUri />
<@s.hidden name="redirectUri" value="${redirectUri}" />
<@s.hidden name="${redirectUri}"/>

In both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:

<@s.hidden name="redirectUri" value="%{redirectUri}" />
<@s.hidden name="%{redirectUri}"/>

Remediation

Developers are strongly advised to upgrade their Apache Struts components to version 2.3.34, 2.5.12 or higher.