GHSA-47qp-8v9g-39hp
Code injection in Apache Struts
Quick fix
GHSA-47qp-8v9g-39hp — org.apache.struts:struts2-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2.3.15.1</version> for org.apache.struts:struts2-coreDetails
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 2.3.15.1# pom.xml: bump <version>2.3.15.1</version> for org.apache.struts:struts2-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2013-2251[ADVISORY]
- https://github.com/apache/struts/commit/3cfe34fefedcf0fdcfcb061c0aea34a715b7de6[WEB]
- https://github.com/apache/struts/commit/630e1ba065a8215c4e9ac03bfb09be9d655c2b6e[WEB]
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90392[WEB]
- https://github.com/apache/struts[PACKAGE]
- https://issues.apache.org/jira/browse/WW-4140[WEB]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2251[WEB]
- http://archiva.apache.org/security.html[WEB]
- http://cxsecurity.com/issue/WLB-2014010087[WEB]
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html[WEB]
- http://seclists.org/fulldisclosure/2013/Oct/96[WEB]
- http://seclists.org/oss-sec/2014/q1/89[WEB]
- http://struts.apache.org/release/2.3.x/docs/s2-016.html[WEB]
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2[WEB]
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.html[WEB]
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html[WEB]
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html[WEB]