Summary
Improves excluded params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader manipulationWho should read this | All Struts 2 developers and users |
---|---|
Impact of vulnerability | ClassLoader manipulation |
Maximum security rating | High |
Recommendation | Developers should immediately upgrade to Struts 2.3.16.2 |
Affected Software | Struts 2.0.0 - Struts 2.3.16.1 |
Reporter | Taki Uchiyama (JPCERT/CC), |
CVE Identifier | CVE-2014-0112 - Incomplete fix for ClassLoader manipulation via ParametersInterceptor CVE-2014-0113 - ClassLoader manipulation via CookieInterceptor when configured to accept all cookies |
Problem
Introduced in version 2.3.16.1 excluded param to block access to getClass() method wasn't sufficient, it's possible to omit that with specially crafted request. Also CookieInterceptor is vulnerable for the same kind of attack when it was configured to accept all cookies (when "*" is used to configure cookiesName
param).
Solution
In Struts 2.3.16.2 improved "class" pattern was introduced directly to ParametersInterceptor and CookieInterceptor.
Backward compatibility
No backward compatibility problems are expected.
Workaround
If you cannot upgrade to version 2.3.16.2 which is strongly advised, you can apply below workarounds:
Exclude 'class' parameter
Replace the previous class related pattern with '(.*\.|^|.*|\[('|"))class(\.|('|")]|\[).*' on the list of excludeParams as below
<interceptor-ref name="params"> <param name="excludeParams">(.*\.|^|.*|\[('|"))class(\.|('|")]|\[).*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param> </interceptor-ref>
It isn't possible to do the same with CookieInterceptor, so don't use wildcard mapping to accept cookie names.