Arbitrary Code Execution Affecting org.apache.struts:struts2-core package, versions [,2.3.34) [2.4,2.5.12)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESTRUTS-31503
- published 6 Sep 2017
- disclosed 5 Sep 2017
- credit Lupin, David Greene, Roland McIntosh
How to fix?
Developers are strongly advised to upgrade their Apache Struts components to version 2.3.34, 2.5.12 or higher.
Overview
Apache Struts2 is a popular open-source framework for developing web applications in the Java programming language.
Affected versions of this package are vulnerable to arbitrary code execution. Using expression literals or forcing expressions in Freemarker tags (see example snippet below), and using request values can lead to remote code execution.
<@s.hidden name="redirectUri" value=redirectUri />
<@s.hidden name="redirectUri" value="${redirectUri}" />
<@s.hidden name="${redirectUri}"/>
In both cases a writable property is used in the value attribute and in both cases this is treated as an expression by Freemarker. Please be aware that using Struts expression evaluation style is safe:
<@s.hidden name="redirectUri" value="%{redirectUri}" />
<@s.hidden name="%{redirectUri}"/>