DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Who should read this | All Struts 2 developers and users |
|---|---|
Impact of vulnerability | Possible Remote Code Execution vulnerability |
Maximum security rating | Important |
Recommendation | Upgrade to Struts 2.5.26 or greater |
Affected Software | Struts 2.0.0 - Struts 2.5.25 |
Reporters | Alvaro Munoz - pwntester at github dot comJPCERT Coordination Center (JPCERT/CC) - vuls at jpcert dot or dot jp Masato Anzai of Aeye Security Lab, inc. |
CVE Identifier | CVE-2020-17530 |
Problem
Some of the tag's attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
...
Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.26 which checks if expression evaluation won't lead to the double evaluation.
...
No issues expected when upgrading to Struts 2.5.26
Workaround
Do no not use forced OGNL evaluation in the tag's attributes based on untrusted/unvalidated user input, please follow out recommendations from the Security Guide.