Overview and Vulnerability Info
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Remote Code Execution (RCE) vulnerability (CVE-2016-3081) has been identified in the REST plugin of Apache Struts. This vulnerability allows attackers to execute arbitrary commands on affected servers by injecting malicious input into RESTful API endpoints, exploiting improper input sanitization mechanisms.
Per the Open Web Application Security Project (OWASP): "Code Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization."
This issue affects multiple versions of the Apache Struts framework, specifically versions 2.3.19 through 2.3.28, excluding versions 2.3.20.3, 2.3.24.3, and 2.3.28.1.
Details
Module Info
- Product: Apache Struts
- Affected packages: REST plugin
- Affected versions: >=2.3.19 <2.3.20.3, >=2.3.21 <2.3.24.3, >=2.3.25 <2.3.28.1
- GitHub repository: https://github.com/apache/struts
- Published packages: https://mvnrepository.com/artifact/org.apache.struts/struts2-core
- Package manager: Maven
- Fixed in: Spring Security 5.6.9 and 5.7.5
Vulnerability Info
CVE-2016-3081 is a high-severity vulnerability that arises from the improper handling of user inputs in RESTful endpoints. Specifically, attackers can exploit the method: prefix in user-provided parameters to invoke arbitrary methods on the server, enabling remote code execution. This flaw was particularly dangerous for legacy systems where REST plugins were enabled without sufficient configuration or security hardening.
Credits
- This vulnerability was disclosed by Nike Zheng from DBAPPSecurity.
Mitigation
Users of the affected components should apply one of the following mitigations:
To mitigate this issue, users should take the following steps:
- Move to secure versions (Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1).
- If your application does not require DMI, disable it to reduce attack vectors.
- Implement strict input validation for RESTful APIs to block malicious inputs.
Leverage a commercial support partner like HeroDevs for post-EOL security support.
