Page History

...

OGNL provides, among other features, extensive expression evaluation capabilities.
A request that included a specially crafted request parameter could be used to inject arbitrary OGNL code into the stack, afterward used as request parameter of an URL Tag , which will cause a further evaluation.

OGNL evaluation was already addressed in S2-003 and S2-005 and S2-009, but, since it involved just the parameter's name, it turned out that the resulting fixes based on whitelisting acceptable parameter names and denying evaluation of the expression contained in parameter names, closed the vulnerability only partially.

The second evaluation happens when redirect result reads it from the stack and uses the previously injected code as redirect parameterURL Tag tries to resolve every parameters present in the original request.
This lets malicious users put arbitrary OGNL statements into any unsanitized String variable exposed by an action request parameter (not necessarily managed by the code) and have it evaluated as an OGNL expression to disable enable method execution and execute arbitrary methods, bypassing Struts and OGNL library protections.

Proof of concept

1. Open HelloWorld.jsp present in the Struts Blank App and add to one of the url tag the following parameter:

   Code Block
   includeParams="all"

   Such that the line will be something look like this:

   Code Block
   xml xml
   <s:url id="url" action="HelloWorld" includeParams="all">

   (I'm pretty sure it works with includeParams="get" as well).
2. Run struts2-blank app
3. Open the
4. Run struts2-showcase
5. Open url: http://localhost:8080/struts2-showcase/skill/editexample/HelloWorld.action?skillName=SPRING-DEV^{Image Removed}write skill name to %{expr} for example: Code Block%{(#_memberAccess['allowStaticMethodAccess']=true)(#context[fakeParam=%25%7B(%23_memberAccess%5B'allowStaticMethodAccess'%5D%3Dtrue)(%23context%5B'xwork.MethodAccessor.denyMethodExecution']=false) #hackedbykxlzx=@org%5D%3Dfalse)(%23writer%3D%40org.apache.struts2.ServletActionContext@getResponseServletActionContext%40getResponse().getWriter(),#hackedbykxlzx%2C%23writer.println('hacked by kxlzx'),#hackedbykxlzx%2C%23writer.close())} submit the form%7D
   (this is the shortenerize version http://goo.gl/lhlTl^{Image Added})

The issue, in order to work, need a redirect result defined as the following:

...