PT-2018-3988 · Apache+2 · Struts2-Core+3

Published 2018-03-27 · Updated 2020-12-08 · CVE-2018-1327

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.5.16

Description The issue is related to the Apache Struts REST Plugin using a vulnerable XStream library, allowing a denial of service (DoS) attack with a malicious request containing a specially crafted XML payload. The vulnerability is also associated with insufficient input validation in the struts2-core library, which can be exploited by a remote attacker using specially formed XML files.

Recommendations For versions prior to 2.5.16, upgrade to Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described. Alternatively, implement a custom XML handler based on the Jackson XML handler from Apache Struts 2.5.16. As a temporary workaround, consider restricting the use of the XStream library until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-91

CWE-20

Related Identifiers

BDU:2024-08703

CVE-2018-1327

GHSA-38CR-2PH5-FRR9

Affected Products

Apache Struts

Jackson

Xstream

Struts2-Core

References · 19

• https://bdu.fstec.ru/vul/2024-08703 · Security Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-1327 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1327 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38cr-2ph5-frr9 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/67ecf3a21608e20449bcb7895b22204b400fecd4 · Note
• https://github.com/apache/struts/commit/9260720568cee9e868d2899228eceed0c3359323 · Note
• https://github.com/apache/struts/commit/4260bee634cb606be6071bce2383fddb510608aa · Note
• http://securitytracker.com/id/1040575 · Note
• https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E · Note
• https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E · Note
• https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E · Note
• https://web.archive.org/web/20200227124859/http://securityfocus.com/bid/103516 · Note
• http://securityfocus.com/bid/103516 · Note