THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
| Excerpt |
|---|
A crafted JSON request can be used to perform a DoS attack when using the Struts REST plugin |
Who should read this | All Struts 2 developers and users which are using the REST plugin |
|---|---|
Impact of vulnerability | A DoS attack is possible when using outdated json-lib with the Struts REST plugin |
Maximum security rating |
Moderate | |
Recommendation | Upgrade to Struts 2.5.14.1 |
|---|
Affected Software |
|---|
Struts 2.5 - Struts 2.5.14 | |
Reporter | Huijun Chen |
|---|
HPE (TBD)
, XiaoLong Zhu - Huawei Technologies | |
CVE Identifier | CVE-2017-15707 |
|---|
CVE Identifier
Problem
The REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
...
Upgrade to Apache Struts version 2.5.14.1 or 2.4. Another solution is to use the Jackson handler instead of the default JSON-lib handler as described here.
Backward compatibility
No backward incompatibility issues are expected.
...
Use Jackson handler instead of the default JSON-lib handler as described here.