PT-2014-2051 · Apache · Apache Struts

Published 2014-03-06 · Updated 2022-05-14 · CVE-2014-0094

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.16.2

Description The issue is related to the ParametersInterceptor in Apache Struts, which allows remote attackers to manipulate the ClassLoader via the class parameter passed to the getClass method. This is due to insufficient input validation, enabling a remote attacker to impact the integrity of protected information using the class parameter.

Recommendations For versions prior to 2.3.16.2, update to version 2.3.16.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the getClass method or validating the class parameter to minimize the risk of exploitation.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

CWE-264

Related Identifiers

BDU:2015-00403

BDU:2022-06318

CVE-2014-0094

GHSA-VRWC-QJMW-5RJM

Affected Products

Apache Struts

References · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_classloader.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41690 · Exploit
• 🔥 https://exploit-db.com/exploits/33142 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0094 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0116 · Security Note
• https://osv.dev/vulnerability/GHSA-vrwc-qjmw-5rjm · Vendor Advisory
• http://struts.apache.org/release/2.3.x/docs/s2-020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06318 · Security Note
• https://bdu.fstec.ru/vul/2015-00403 · Security Note
• http://secunia.com/advisories/56440 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/6315241719be167542962da436b38782ed730c62 · Note
• https://github.com/apache/struts/commit/2e2da292166adbc78c4cb1e308b30ddb4fba6d3f · Note
• https://ibm.com/support/pages/security-bulletin-ibm-sterling-order-management-ibm-sterling-configure-price-quote-and-sterling-web-channel-are-affected-apache-struts-2-security-vulnerabilities · Note
• https://cwiki.apache.org/confluence/display/WW/S2-020 · Note