You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

Summary

Improves excluded params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader manipulation

Who should read this

All Struts 2 developers and users

Impact of vulnerability

ClassLoader manipulation

Maximum security rating

High

Recommendation

Developers should immediately upgrade to Struts 2.3.16.2

Affected Software

Struts 2.0.0 - Struts 2.3.16.1

Reporter

Taki Uchiyama (JPCERT/CC),
Takeshi Terada (Mitsui Bussan Secure Directions, Inc.),
Takayoshi Isayama (Mitsui Bussan Secure Directions, Inc.),
Yoshiyuki Karezaki (Yoshiyuki.Karezaki at scsk.jp)
BAKA/ty (121605589 at qq.com),
Shine (1983059165 at qq.com),
NSFOCUS Security Team,
heige (zhoujp at knownsec.com)

CVE Identifier

CVE-2014-0112 - Incomplete fix for ClassLoader manipulation via ParametersInterceptor

CVE-2014-0113 - ClassLoader manipulation via CookieInterceptor when configured to accept all cookies

Problem

Introduced in version 2.3.16.1 excluded param to block access to getClass() method wasn't sufficient, it's possible to omit that with specially crafted request. Also CookieInterceptor is vulnerable for the same kind of attack when it was configured to accept all cookies (when "*" is used to configure cookiesName param).

Solution

In Struts 2.3.16.2 improved "class" pattern was introduced directly to ParametersInterceptor and CookieInterceptor.

Backward compatibility

No backward compatibility problems are expected.

Workaround

If you cannot upgrade to version 2.3.16.2 which is strongly advised, you can apply below workarounds:

Exclude 'class' parameter

Replace the previous class related pattern with '(.*\.|^|.*|\[('|"))class(\.|('|")]|\[).*' on the list of excludeParams as below

<interceptor-ref name="params">
  <param name="excludeParams">(.*\.|^|.*|\[('|"))class(\.|('|")]|\[).*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
</interceptor-ref>

It isn't possible to do the same with CookieInterceptor, so don't use wildcard mapping to accept cookie names or implement your own version of CookieInterceptor based on code provided in Struts 2.3.16.2.

  • No labels