Versions Compared

Old Version 4

changes.mady.by.user Yasser Zamani

Saved on

compared with

New Version 5

changes.mady.by.user Lukasz Lenart

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn’t have value and action set.

Maximum security rating

Critical

Recommendation

Upgrade to Struts 2.3.35 or Struts 2.5.17

Affected Software

Struts 2.3 - Struts 2.3.34, Struts 2.5 - Struts 2.5.16

The unsupported Struts versions may be also affected

Reporter

Man Yue Mo from the Semmle Security Research team

CVE Identifier

CVE-2018-11776

...

Both 2.3.35 and 2.5.17 versions contain the security fixes only, nothing more. No backward incompatibility issues are expected.

Warning

We do get reports that in some cases backward compatibility issues can occur, it is related to usage of ArrayList directly in conversion logic. You should see a WARN in logs that the ArrayList is excluded. In such case please define the below constant in your struts.xml

Code Block
xml
xml
<constant name="struts.excludedPackageNames" value="
    ognl.,
    javax.,
    freemarker.core.,
    freemarker.template.,
    freemarker.ext.rhino.,
    sun.reflect.,
    javassist.,
    com.opensymphony.xwork2.ognl.,
    com.opensymphony.xwork2.security." 
/>

We are working on a new release to fix that problem.

Workaround

Note

This is a temporal weak workaround. Please upgrade to Apache Struts version 2.3.35 or 2.5.17 ASAP because they also contain critical overall proactive security improvements

...