PT-2019-6685 · Apache · Apache Struts

Arun Babu Neelicattu · Published 2019-11-01 · Updated 2022-04-22 · CVE-2011-3923

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.1.2

Description The issue allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. This is due to a regular expression in ParametersInterceptor that incorrectly matches certain expressions, such as top['foo'](0), as valid. The OGNL library treats this as (top['foo'])(0) and evaluates the value of the 'foo' action parameter as an OGNL expression. This enables malicious users to put arbitrary OGNL statements into any String variable exposed by an action, having it evaluated as an OGNL expression. Since the OGNL statement is in the HTTP parameter value, attackers can use blacklisted characters to disable method execution and execute arbitrary methods, bypassing the ParametersInterceptor and OGNL library protections.

Recommendations For Apache Struts versions prior to 2.3.1.2, update to version 2.3.1.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ParametersInterceptor class and limiting the evaluation of OGNL expressions in action parameters until a patch is applied. Avoid using blacklisted characters in HTTP parameter values to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Code Injection

Weakness Enumeration

CWE-732

CWE-94

Related Identifiers

CVE-2011-3923

GHSA-J68F-8H6P-9H5Q

Affected Products

Apache Struts

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb · Exploit
• 🔥 https://exploit-db.com/exploits/24874 · Exploit
• 🔥 http://exploit-db.com/exploits/24874 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jul/38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3923 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-3923 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j68f-8h6p-9h5q · Vendor Advisory
• http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-struts2.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72585 · Note
• http://securityfocus.com/bid/51628 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3923 · Note
• http://struts.apache.org/development/2.x/docs/s2-009.html · Note
• http://securitytracker.com/id?1026575 · Note
• https://web.archive.org/web/20140725074137/http://seclists.org/fulldisclosure/2014/Jul/38 · Note