Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Remote Code Execution (RCE) vulnerability (CVE-2018-11776) has been identified in Apache Struts, which allows attackers to execute arbitrary code on the target system by sending specially crafted requests. This can compromise system integrity and lead to further exploitation.
Per Crowdstrike: Remote code execution (RCE) refers to a class of cyberattacks in which attackers remotely execute commands to place malware or other malicious code on your computer or network. An RCE vulnerability can compromise a user’s sensitive data without the hackers needing to gain physical access to your network.
This issue affects multiple versions. Struts 2.0.4 - Struts 2.3.34, Struts 2.5.0 - Struts 2.5.16
Details
Module Info
- Product: Apache Struts
- Affected packages: struts-core
- Affected versions: >=2.3.0 & <=2.3.34, >=2.5.0 & <2.5.16
- GitHub repository: https://github.com/apache/struts
- Package manager: Maven
- Fixed in: >=2.3.34 and >=2.5.16
Vulnerability Info
The vulnerability arises due to improper handling of namespaces and results when the alwaysSelectFullNamespace option is enabled. It can be exploited by an attacker to execute arbitrary code on the server. Those using affected versions of Apache Struts should upgrade to patched versions and follow recommended security practices to mitigate this risk.
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade to patched version 2.3.35 or 2.5.17
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Yasser Zamani - Apache Struts Security Bulletins
