PT-2013-1359 · Apache · Apache Struts

Douglas Rodrigues + 1 · Published 2013-05-24 · Updated 2022-05-13 · CVE-2013-2115

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.14.2

Description The issue is related to incorrect code generation management when handling the includeParams attribute, allowing a remote attacker to execute arbitrary code by sending a specially crafted request. This can lead to remote command execution, session access and manipulation, and XSS attacks. The includeParams attribute in the s:url and s:a tags is used to determine whether to include HTTP request parameters or not, with allowed values being none, get, or all. A specially crafted request parameter can inject arbitrary OGNL code into the stack, which is then evaluated as an OGNL expression, enabling method execution and bypassing Struts and OGNL library protections.

Recommendations For Apache Struts versions prior to 2.3.14.2, update to version 2.3.14.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the includeParams attribute in the s:url and s:a tags to minimize the risk of exploitation. Avoid using the all value for the includeParams attribute, and instead use none or get to limit the inclusion of request parameters.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-06025

CVE-2013-2115

GHSA-7GHM-RPC7-P7G5

Affected Products

Apache Struts

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_include_params.rb · Exploit
• 🔥 https://exploit-db.com/exploits/25980 · Exploit
• https://osv.dev/vulnerability/GHSA-7ghm-rpc7-p7g5 · Vendor Advisory
• http://struts.apache.org/development/2.x/docs/s2-014.html · Vendor Advisory
• https://cwiki.apache.org/confluence/display/WW/S2-014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06025 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2115 · Security Note
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/fed4f8e8a4ec69b5e7612b92d8ce3e476680474 · Note
• https://github.com/apache/struts/commit/ea96d18d0f75c390d2595648efa3563785c272c6 · Note
• https://github.com/apache/struts/commit/d7804297e319c7a12245e1b536e565fcea6d650 · Note
• https://github.com/apache/struts/commit/d934c6e7430b7b98e43a0a085a2304bd31a75c3d · Note
• http://securityfocus.com/bid/60167 · Note
• https://web.archive.org/web/20140212000331/http://securityfocus.com/bid/60167 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note