The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in
    Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote
    attackers to modify server-side context objects and bypass the "#" protection mechanism in
    ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver,
    (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly
    other OGNL context variables, a different vulnerability than CVE-2008-6504. (CVE-2010-1870)

The version of Apache Struts running on the remote host is 2.x prior to 2.2.1. It, therefore, is affected by a possible remote code execution vulnerability when OGNL expressions are evaluated due to improper validation by the ParametersInterceptor class.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web application appears to use Struts 2, a web framework that uses XWork. Due to a vulnerability in XWork, it is possible to disable settings designed to prevent remote code execution.

A remote attacker can exploit this by submitting an HTTP request containing specially crafted OGNL statements, resulting in the execution of arbitrary Java.

Note that versions of Apache Archiva includes Struts and may be affected.

ID	Name	Product	Family	Type	Severity
420305	SCA: security update for org.apache.struts:struts2-core (GHSA-x5fc-pgpx-59j5)	Tenable Cloud Security	SCA Checks	Local	medium
420305	SCA: security update for org.apache.struts:struts2-core (GHSA-x5fc-pgpx-59j5)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
117363	Apache Struts 2.x < 2.2.1 OGNL RCE (S2-005)	Nessus	Misc.	Combined	medium
47900	Apache Struts 2 / XWork Remote Code Execution (safe check)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2010-1870

medium

Tenable Plugins

medium

medium

medium

critical