Summary
Remote Code Execution can be performed when using REST Plugin.Who should read this | All Struts 2 developers and users |
---|---|
Impact of vulnerability | Possible Remote Code Execution |
Maximum security rating | High |
Recommendation | Upgrade to Struts 2.3.29. |
Affected Software | Struts 2.3.20 - Struts Struts 2.3.28.1 |
Reporter | Chao Jack jc1990999 at yahoo dot com |
CVE Identifier | CVE-2016-4438 |
Problem
It is possible to pass a malicious expression which can be used to execute arbitrary code on server side when using the REST Plugin.
Solution
Upgrade to Apache Struts version 2.3.29.
Backward compatibility
Some backward incompatibility issues are expected when upgrading to Struts 2.3.28 - it can happen that some OGNL expressions stop working because of performing disallowed arithmetic operations and assigments.
Workaround
Not possible as this fix requires changes in OGNL and how Struts uses OGNL in certain aspects.