[Japanese]

JVNDB-2017-000012

Java (OGNL) code execution in Apache Struts 2 when devMode is enabled

Overview

Apache Struts 2 provided by the Apache Software Foundation is a software framework for creating Java web applications. There is a known risk that arbitrary Java (OGNL) code may be executed in Apache Struts 2 when devMode is enabled in production environment.
It is confirmed that proof-of-concept code exploiting this issue is publicly available.

Hiroshi Fujimoto and Ken Kitahara of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 5.6 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products


Apache Software Foundation
  • Apache Struts 2.3.30 and earlier
  • Apache Struts 2.5.1 and earlier

The developer confirmed this issue does not exist in Apache Struts 2.3.31 and upper versions of Apache Struts 2.5.2.
Impact

An attacker who has access to Apache Struts 2 may execute arbitrary Java (OGNL) code.
Solution

[Update the Software]
Users of affected versions are recommended to update to the latest version.

[Disable devMode]
The developer has already published Apache Struts 2 documentation describing the risk when devMode is enabled in production.
Disable devMode unless it is necessary to be enabled.
Vendor Information

Apache Software Foundation
CWE (What is CWE?)

  1. Improper Input Validation(CWE-20) [IPA Evaluation]
CVE (What is CVE?)

References

  1. JVN : JVN#92395431
Revision History

  • [2017/01/20]
      Web page was published

Date Public2017/01/20
Date First Published2017/01/20
Date Last Updated2017/01/20