Apache Struts2 Core cross-origin protection exemption miskeyed to deployment-wide path
Original title: Apache Struts2 Core Cross-Origin Protection Exemption Miskeyed to a Deployment-Wide Path
Miskeyed exemptedPaths in Struts2 Core interceptors allows bypass of cross-origin protections for entire deployment
Apache Struts2 Core version 7.4.0 and below's FetchMetadataInterceptor, CoepInterceptor, and CoopInterceptor compare exemptedPaths against HttpServletRequest.getContextPath(). getContextPath() is fixed for the entire deployed web application. This results in cross-origin protection being exempted for a deployment-wide path instead of per-reference.
- exemptedPaths compared against getContextPath()
- Fixed for entire deployed web application
- Affects versions 7.4.0 and below
- Intended to exempt specific actions from cross-origin protection
Impact: bypassing of cross-origin protection for deployment-wide path
- Vendors
- Apache
- Products
- Struts2 Core
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 01 Description Apache Struts2 Core version 7. 4. 0 and below's `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each compare their `exemptedPaths` configuration -- a per-interceptor-reference, administrator-supplied set of paths intended to exempt specific actions from the corresponding cross-origin protection -- against `HttpServletRequest.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.