You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

Summary

Double OGNL evaluation when using raw user input in tag's attributes.

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution vulnerability

Maximum security rating

Important

Recommendation

Always validate incoming parameters' values when re-assigning them to certain Struts' tags attributes. Alternatively upgrade to Struts 2.3.27

Affected Software

Struts 2.0.0 - Struts Struts 2.3.24.1

Reporter

Romain Gaucher rgaucher at coverity dot com - Coverity
Lupin lupin1314 at gmail dot com 

CVE Identifier

CVE-2016-0785

Problem

The Apache Struts frameworks when forced, performs double evaluation of attributes' values assigned to certain tags so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered.

Solution

Adding a proper validation of each value that's coming in and it's used in tag's attributes. Or don't use forced evaluation of an attribute using %{...} syntax. Alternatively upgrade to Struts 2.3.27.

Backward compatibility

No issues expected when upgrading to Struts 2.3.27

Workaround

If you are using Struts 2.3.20, 2.3.24 or 2.3.24.1 you can redefine struts.excludedClasses as showed below, for more details please read internal security page.

    <constant name="struts.excludedClasses"
              value="
                java.lang.Object,
                java.lang.Runtime,
                java.lang.System,
                java.lang.Class,
                java.lang.ClassLoader,
                java.lang.Shutdown,
                java.lang.ProcessBuilder,
                ognl.OgnlContext,
                ognl.ClassResolver,
                ognl.TypeConverter,
                com.opensymphony.xwork2.ognl.SecurityMemberAccess,
                com.opensymphony.xwork2.ActionContext" />
  • No labels