Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Remote Code Execution (RCE) vulnerability (CVE-2024-53677) has been identified in Apache Struts, which allows attackers to execute arbitrary code on the target system by sending specially crafted requests. This can compromise system integrity and lead to further exploitation.
Per Crowdstrike: Remote code execution (RCE) refers to a class of cyberattacks in which attackers remotely execute commands to place malware or other malicious code on your computer or network. An RCE vulnerability can compromise a user’s sensitive data without the hackers needing to gain physical access to your network.
This issue affects multiple versions from 2.0.0 before 6.4.0.
Details
Module Info
- Product: Apache Struts
- Affected packages: struts-core
- Affected versions: >=2.0.0 <=2.3.37, >=2.5.0 <=2.5.33, >=6.0.0 <=6.3.0.2
- GitHub repository: https://github.com/apache/struts
- Package manager: Maven
- Fixed in:
- NES for Spring Essentials+ Struts v2.5.35
Vulnerability Info
A Struts application using FileUploadInterceptor for file uploads is vulnerable to path traversal attacks. Malicious requests can override file names, saving files in restricted locations and potentially leading to remote code execution.
Steps To Reproduce
A public reproduction of the issue has been published and is available here. By including an extra parameter to override the file name, an attacker can save the file in an unintended location.
Mitigation
Struts 2.5.x is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Users should upgrade to the patched version Struts 6.4.0 or latest version and migrate to the new file upload mechanism.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
Shinsaku Nomura - Apache Struts Security Bulletins
