Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
An Authorization Bypass vulnerability (CVE-2016-1181) has been identified in Apache Struts, which allows attackers to execute arbitrary code on the target system by sending specially crafted requests. This can compromise system integrity and lead to further exploitation.
Per OWASP: Authorization Bypass occurs when an application fails to properly enforce access controls, allowing attackers to gain unauthorized access to restricted functionalities or data. This vulnerability arises when security mechanisms meant to verify user privileges are missing, misconfigured, or can be circumvented through crafted requests. Attackers can exploit authorization flaws to escalate privileges, access sensitive information, or perform actions as other users.
This issue affects multiple versions >=1.0.0 <=1.3.10
Details
Module Info
- Product: Apache Struts 1
- Affected packages: struts-core
- Affected versions: >=1.0.0 <=1.3.10
- GitHub repository: https://github.com/apache/struts1
- Package manager: Maven
- Fixed in: NES for Struts Struts 1 v1.3.11
Vulnerability Info
The Apache Struts 1.x versions up to and including 1.3.10 contain a vulnerability in ActionServlet.java, which improperly handles multithreaded access to an ActionForm instance. This flaw allows remote attackers to execute arbitrary code or cause a denial of service (DoS) by exploiting shared state conditions in multipart requests. Specially crafted requests using the same session can manipulate shared properties while earlier requests are still being processed, potentially leading to unexpected memory access and unauthorized property modifications.
Mitigation
Struts 1 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Struts 2
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
