Security Affairs newsletter Round 503 by Pierluigi Paganini

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Apache Struts contains a flaw in its legacy file upload logic (CWE-434) that allows an attacker to manipulate file upload parameters to traverse paths outside the intended upload directory. It is triggered when an application relies on the old upload mechanism built around FileuploadInterceptor; applications using the new file upload mechanism are not affected. By uploading a malicious file to a location where it can be executed, an attacker can, under some circumstances, achieve remote code execution on the server. All Apache Struts versions from 2.0.0 up to but not including 6.4.0 are affected, though only deployments still using the legacy upload interceptor. There is no public PoC or CISA KEV entry yet, but EPSS is exceptionally high (78.2%, 100th percentile) and news reports indicate threat actors are already attempting to exploit the flaw in the wild.

Do: Upgrade Apache Struts to version 6.4.0 or later and migrate applications to the new file upload mechanism. If upgrading is not immediately possible, verify whether your application uses the legacy FileuploadInterceptor; if it does not, the application is safe. Review upload parameter handling and monitor the official S2-067 advisory for mitigation details, as active exploitation attempts have been reported.