THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
Summary
| Excerpt |
|---|
Remote code exploit on form validation error |
Who should read this | All Struts 2 developers |
|---|---|
Impact of vulnerability | Remote code execution |
Maximum security rating | Critical |
Recommendation | Developers should either apply the patch or upgrade XWork immediately |
Affected Software | WebWork 2.1 (with altSyntax enabled), WebWork 2.2.0 - WebWork 2.2.5, Struts 2.0.0 - Struts 2.0.8 |
Non-Affected Software | WebWork 2.0, WebWork 2.1 (with altSyntax disabled, which is the default) |
Original JIRA Ticket |
Problem
The 'altSyntax' feature of WebWork 2.1+ and Struts 2 allows OGNL expressions to be inserted into text strings and is processed recursively. This allows a malicious user to submit a string, usually through an HTML text field, containing an OGNL expression that will then be executed by the server if the form validation has failed. For example, say we had this form that required the 'phoneNumber' field to not be blank:
...
The OGNL parsing code is actually in XWork and not in WebWork 2 or Struts 2.
Solution
The fixed version of XWork changes the OGNL parsing so that it is not recursive. Therefore, in the example above, the result will be the expected %{1+1}. You can either obtain the latest version of WebWork 2 or Struts 2, which contains the fixed XWork library, or download the fixed XWork library directly. Alternatively, you can obtain the patch and apply it to the XWork source code yourself.