DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Who should read this | All Struts 2 developers |
|---|---|
Impact of vulnerability | Remote command execution |
Maximum security rating | Critical |
Recommendation | Developers should immediately upgrade to Struts 2.3.1.2 or read the following solution instructions carefully for a configuration change to mitigate the vulnerability |
Affected Software | Struts 2.0.0 - Struts 2.3.1.1 |
Reporter | Meder Kydyraliev, Google Security Team |
CVE Identifier | |
Original Description | Reported directly to security@struts.a.o |
Problem
OGNL provides, among other features, extensive expression evaluation capabilities. The vulnerability allows a malicious user to bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.
...