Apache Struts ParametersInterceptor Arbitrary Code Execution Vulnerability

Apache Struts ParametersInterceptor Arbitrary Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Apache Group Struts <2.3.16.2
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-0112
 
Struts is an open source architecture used to build Web applications.
 
In versions earlier than Apache Struts 2.3.16.2, ParametersInterceptor does not properly restrict access to the getClass method, which allows remote attackers to tamper with ClassLoader and execute arbitrary code.

Send XML and JSON data asynchronously in Struts

Getting started instance of Struts2

Note: This vulnerability is caused by incomplete CVE-2014-0094 patching.
 
<* Source: vendor

Link: http://www.securityfocus.com/archive/1/archive/1/531952/100/0/threaded
Http://struts.apache.org/release/2.3.x/docs/s2-021.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Apache Group
------------
Apache Group has released a Security Bulletin (s2-021) and patches for this:
S2-021: ClassLoader manipulation
Link: http://struts.apache.org/release/2.3.x/docs/s2-021.html

Struts details: click here
Struts: click here

This article permanently updates the link address: