PT-2016-3436 · Apache · Apache Struts

Nixawk · Published 2016-04-19 · Updated 2022-05-14 · CVE-2016-3081

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.20.2 Apache Struts versions 2.3.21 through 2.3.24.1 Apache Struts versions 2.3.25 through 2.3.28

Description The issue is related to the implementation of the Dynamic Method Invocation (DMI) mechanism in Apache Struts, which fails to properly sanitize input data. This allows a remote attacker to execute arbitrary code using the method: prefix, related to chained expressions.

Recommendations For Apache Struts versions 2.3.19 through 2.3.20.2, update to a version outside of this range to mitigate the risk. For Apache Struts versions 2.3.21 through 2.3.24.1, update to a version outside of this range to mitigate the risk. For Apache Struts versions 2.3.25 through 2.3.28, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider disabling Dynamic Method Invocation until a patch is available.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-05996

CVE-2016-3081

GHSA-8C6J-FFMF-Q6VM

Affected Products

Apache Struts

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/39756 · Exploit
• 🔥 http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html · Exploit
• http://oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3081 · Security Note
• https://struts.apache.org/docs/s2-032.html · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpujul2016-2881720.html · Patch
• https://bdu.fstec.ru/vul/2022-05996 · Security Note
• https://osv.dev/vulnerability/GHSA-8c6j-ffmf-q6vm · Vendor Advisory
• https://github.com/apache/struts · Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en · Note
• https://web.archive.org/web/20210226011418/http://securitytracker.com/id/1035665 · Note
• http://securityfocus.com/bid/87327 · Note
• https://ibm.com/blogs/psirt/security-bulletin-ibm-call-center-and-apache-struts-struts-upgrade-strategy-various-cves-see-below · Note