Expert discovered a Critical Remote Code Execution flaw in Apache Struts
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-11776 | Apache Struts Remote Code Execution via Missing or Wildcard Namespace Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority. Do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values. | 8.1 | 100% | KEV PoC ×5 |
| massmillions of end users behind on the order of tens of thousands of internet-exposed Apache Struts deployments |
Full article521 words · extracted from securityaffairs.com · click to collapse
Maintainers of the Apache Struts 2 open source development framework has released security updates to address a critical remote code execution vulnerability.
Security updates released this week for the Apache Struts 2 open source development framework addressed a critical RCE tracked as CVE-2018-11776.
The vulnerability affects Struts versions from 2.3 through 2.3.34, Struts 2.5 through 2.5.16, and possibly unsupported versions of the framework.
The versions Struts 2.3.35 and 2.5.17 includes the security updates to address the CVE-2018-11776.
Struts developers also published a temporary workaround, but are recommending users to don’t use it and install the updates.
“Possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn’t have value and action se” reads the security advisory published by Apache.
“Possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn’t have value and action set.”
Experts warn that it is possible to trigger the RCE flaw when namespace value isn’t set for a result defined in underlying xml configurations and at the same time, its upper action(s) configurations have no or wildcard namespace.
The flaw could be also exploited when using url tag which doesn’t have value and action set and at the same time, its upper action(s) configurations have no or wildcard namespace.
The vulnerability was reported by Man Yue Mo from the Semmle Security Research team on April 10, security updates were released on June 25 and on 22 August 2018 the new versions of Struts were released.
“This vulnerability is caused by insufficient validation of untrusted user data in the core of the Struts framework. Due to the fact that this vulnerability affects the core of Struts, there exist multiple separate attack vectors. At the moment, we are aware of two such vectors” reads the technical analysis published bb Semmle.
“For your application to be vulnerable to the attack vectors described below, both of the following conditions should hold:
- The alwaysSelectFullNamespace flag is set to true in the Struts configuration. Note that this is automatically the case if your application uses the popular Struts Convention plugin.
- Your application’s Struts configuration file contains an <action …>tag that does not specify the optional namespace attribute, or specifies a wildcard namespace (e.g. “/*”)”
The experts from Semmle explained that the flaw affects commonly-used endpoints of Struts which are likely to be exposed.
“Attackers can attack vulnerable applications by injecting their own namespace as a parameter in an HTTP request. The value of that parameter is insufficiently validated by the Struts framework, and can be any OGNL string. OGNL (Object-Graph Navigation Language) is a powerful domain-specific language that is used to customize Apache Struts’ behavior,” the researcher explained.
Apache Struts flaw are very dangerous for organizations, one of them was the root cause of the massive Equifax breach that impacted over 140 million people.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Apache Struts, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/75557/hacking/apache-struts-cve-2018-11776.html