THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
Who should read this | All Struts 2 developers and users |
|---|---|
Impact of vulnerability | Possible Remote Code Execution vulnerability |
Maximum security rating | Important |
Recommendation | Always validate incoming parameters' values when re-assigning them to certain Struts' tags attributes. Alternatively upgrade to Struts 2.3.2627 |
Affected Software | Struts 2.0.0 - Struts Struts 2.3.24.1 |
Reporter | Romain Gaucher rgaucher at coverity dot com - Coverity |
CVE Identifier | CVE-2016-0785 |
...
Adding a proper validation of each value that's coming in and it's used in tag's attributes. Alternatively upgrade to Struts 2.3.2627.
Backward compatibility
No issues expected when upgrading to Struts 2.3.26
Workaround
...
If you are using Struts 2.3.20, 2.3.24 or 2.3.24.1 you can redefine struts.excludedClasses as showed below, for more details please read internal security page.
| Code Block | ||||
|---|---|---|---|---|
| ||||
<constant name="struts.excludedClasses"
value="
java.lang.Object,
java.lang.Runtime,
java.lang.System,
java.lang.Class,
java.lang.ClassLoader,
java.lang.Shutdown,
java.lang.ProcessBuilder,
ognl.OgnlContext,
ognl.ClassResolver,
ognl.TypeConverter,
com.opensymphony.xwork2.ognl.SecurityMemberAccess,
com.opensymphony.xwork2.ActionContext" /> |