Code injection in Apache Struts
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms. In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-2251US | critical9.8OT critical | KEV | ||
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: p… | ||||
references
External citations — patches, advisories, analysis.
- http://archiva.apache.org/security.htmlWEB
- http://cxsecurity.com/issue/WLB-2014010087WEB
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.htmlWEB
- http://seclists.org/fulldisclosure/2013/Oct/96WEB
- http://seclists.org/oss-sec/2014/q1/89WEB
- http://struts.apache.org/release/2.3.x/docs/s2-016.htmlWEB
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2WEB
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-bpm-analytics-201301e.htmlWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan