Apache Struts2 Core 7.4.0 and below allows arbitrary code execution via OGNL sandbox escape
Original title: Apache Struts2 Core Arbitrary Code Execution via OGNL Sandbox Escape
The OGNL sandbox in Apache Struts2 Core 7.4.0 and below can be bypassed using nested arguments that invoke reflection, allowing arbitrary code execution.
Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code execution via Object-Graph Navigation Language (OGNL) through several different mechanisms but only in a cursory fashion -- the libraries only guard against immediate calls evaluated by the OGNL engine via SecurityMemberAccess, but an allowed call that accepts nested arguments and itself invokes reflection internally executes outside of the sandbox.
- The sandbox only guards against immediate calls via SecurityMemberAccess
- Nested calls that invoke reflection execute outside the sandbox
- This allows arbitrary code execution in vulnerable versions
Impact: arbitrary code execution
- Vendors
- Apache
- Products
- Struts2 Core
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 01 Description Apache Struts2 Core version 7. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.