Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2011-1772US | low2.6 | Exploit | ||
Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arb… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://jvn.jp/en/jp/JVN25435092/index.htmlWEB
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000106WEB
- http://secureappdev.blogspot.com/2011/05/apache-struts-2-xwork-webwork-reflected.htmlWEB
- http://struts.apache.org/2.2.3/docs/version-notes-223.htmlWEB
- http://struts.apache.org/2.x/docs/s2-006.htmlWEB
- https://github.com/apache/strutsPACKAGE
- https://issues.apache.org/jira/browse/WW-3579WEB
- https://nvd.nist.gov/vuln/detail/CVE-2011-1772ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan