The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.

The version of Apache Struts installed on the remote host is prior to 2.3.18. It is, therefore, affected by multiple vulnerabilities as referenced in the S2-008 advisory.

  - The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL     expressions during certain exception handling for mismatched data types of properties, which allows remote     attackers to execute arbitrary Java code via a crafted parameter. (CVE-2012-0391)

  - The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist,     which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers     Java code execution through a static method. (CVE-2012-0392)

  - The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public     constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter     that triggers the creation of a Java object. (CVE-2012-0393)

  - The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows     remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes     this behavior as not a security vulnerability itself. (CVE-2012-0394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL
    expressions during certain exception handling for mismatched data types of properties, which allows remote
    attackers to execute arbitrary Java code via a crafted parameter. (CVE-2012-0391)

The remote web application appears to use Struts 2, a web framework that utilizes OGNL (Object-Graph Navigation Language) as an expression language. Due to an error in the way that the ExceptionDelegator component handles mismatched data types, an unauthenticated, remote attacker can execute arbitrary commands on the remote host by sending a specially crafted request order. This flaw is due to the ExceptionDelegator interpreting parameter values as OGNL expressions when there is a conversion error. 

Note that this plugin will only report the first vulnerable instance of a Struts 2 application.

ID	Name	Product	Family	Severity
279485	Apache Struts 2.0.0 < 2.3.18 multiple vulnerabilities - Remote command execution and arbitrary file overwrite, Strict DMI does not work correctly(S2-008)	Nessus	Misc.	critical
432604	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-4wrr-9h5r-m92w)	Tenable Cloud Security	SCA Checks	critical
432604	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-4wrr-9h5r-m92w)	Tenable Self-Hosted Container Security	SCA Checks	critical
69240	Apache Struts 2 ExceptionDelegator Arbitrary Remote Command Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2012-0391

critical

Tenable Plugins

critical

critical

critical

high