...
Excerpt |
---|
Improves excluded params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader manipulation |
Who should read this | All Struts 2 developers and users |
---|---|
Impact of vulnerability | ClassLoader manipulation |
Maximum security rating |
Important | |
Recommendation | Developers should immediately upgrade to Struts 2.3. |
---|
Affected Software | Struts 2.0.0 - Struts 2.3.16. |
---|
3 |
Reporter |
---|
NTT-CERT via JPCERT/CC |
, |
Nebula (Chibi, Hubei, CN), HelloWorld security team, | |
CVE Identifier | CVE-2014-0112 - Incomplete fix for ClassLoader manipulation via ParametersInterceptor CVE-2014-0113 - ClassLoader manipulation via CookieInterceptor when configured to accept all cookies |
---|
Problem
The default upload mechanism in Apache Struts 2 is based on Commons FileUpload version 1.3 which is vulnerable and allows DoS attacks. Additional ParametersInterceptor allows access to 'class' parameter which is directly mapped to getClass() method and allows ClassLoader manipulationexcluded parameter pattern introduced in version 2.3.16.1 to block access to getClass() method wasn't sufficient. It is possible to omit that with specially crafted requests. Also CookieInterceptor is vulnerable for the same kind of attack when it was configured to accept all cookies (when "*" is used to configure cookiesName
param).
Solution
In Struts 2.3.16.1, Commons FileUpload was updated to version 1.3.1 and 20 improved "class" pattern was added to excludeParams in struts-default.xml configuration of ParametersInterceptorintroduced directly to ParametersInterceptor and CookieInterceptor.
Backward compatibility
No backward compatibility problems are expected.
Workaround
If you cannot upgrade to version 2.3.
...
20 immediately - which is strongly advised
...
- you can apply below workarounds:
Upgrade commons-fileupload
The fixed commons-fileupload library is a drop-in replacement for the vulnerable version. Deployed applications can be hardened by replacing the commons-fileupload jar file in WEB-INF/lib with the updated jar. For Maven
based Struts 2 projects, the following dependency needs to be added:
Code Block |
---|
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>1.3.1</version>
</dependency> |
Exclude 'class' parameter
Exclude 'class' parameter
Replace the previous class related pattern with '(.*\.|^|.*|\[('|"))class(\.|('|")]|\[).*' on the Simple add '^class\.*' to the list of excludeParams as below
Code Block |
---|
<interceptor-ref name="params"> <param name="excludeParams">^class\.>(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param> </interceptor-ref> |
It isn't possible to do the same with CookieInterceptor, so don't use wildcard mapping to accept cookie names or implement your own version of CookieInterceptor based on code provided in Struts 2.3.20.
Please be aware that this workaround is not as complete as the corrections in Struts 2.3.20