Versions Compared

Old Version 2

changes.mady.by.user Lukasz Lenart

Saved on

compared with

New Version Current

changes.mady.by.user Lukasz Lenart

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Excerpt

XSLTResult can be used to parse arbitrary stylesheet


Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution

Maximum security rating

Medium

Moderate

Recommendation

Always validate type and content of uploaded files, do not expose them directly in your web application. Alternatively upgrade to Struts 2.3.20.

2

3, Struts 2.3.24.

2

3 or Struts 2.3.28.1.

Affected Software

Struts 2.0.0 - Struts Struts 2.3.28 (except 2.3.20.

2

3 and 2.3.24.

2

3)

Reporter

Genxor Sue

GENXOR - genxors at gmail dot com - Qihoo 360 SkyEye Lab

CVE Identifier

CVE-2016-3082

Problem

XSLTResult can accept  allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely execute arbitrary executable code.

Solution

Alway Always validate type and content of uploaded files. We encourage you to upgraded upgrade to one of the versions of the Apache Struts presented above.

...

No issues expected when upgrading to Struts 2.3.20.23, 2.3.24.2 3 and 2.3.28.1

Workaround

Implement your own XSLTResult based on code of the recommended versions.