Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted
    request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
    (CVE-2013-1966)

The version of Apache Struts running on the remote host is 2.x prior to 2.3.14.2. It, therefore, is affected by a remote code execution vulnerability in the URL and Anchor tags due to a flaw in handling the includeParams attribute. A remote, unauthenticated attacker can exploit this issue, via a specially crafted request to inject arbitrary OGNL code into the stack and execute arbitrary methods, bypassing Struts and OGNL library protections.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Struts running on the remote host is 2.x prior to 2.3.14.2. It, therefore, is affected by multiple vulnerabilities including a remote command execution vulnerability and a cross-site scripting (XSS) vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web application appears to use Struts 2, a web framework that utilizes OGNL (Object-Graph Navigation Language) as an expression language. Due to a flaw in the evaluation of an OGNL expression, a remote, unauthenticated attacker can exploit this issue to execute arbitrary commands on the remote web server by sending a specially crafted HTTP request. 

Note this issue exists because of an incomplete fix for CVE-2013-1966. 

Note that this version of Struts 2 is reportedly also affected by multiple cross-site scripting (XSS) vulnerabilities as well as session access and manipulation attacks; however, Nessus has not tested for these issues. 

Note that this plugin will only report the first vulnerable instance of a Struts 2 application.

ID	Name	Product	Family	Severity
411771	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-737w-mh58-cxjp)	Tenable Cloud Security	SCA Checks	high
411771	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-737w-mh58-cxjp)	Tenable Self-Hosted Container Security	SCA Checks	high
117401	Apache Struts 2.x < 2.3.14.2 Remote Code Execution Vulnerability (S2-013)	Nessus	Misc.	critical
117364	Apache Struts 2.x < 2.3.14.2 Multiple Vulnerabilities (S2-014)	Nessus	Misc.	high
66935	Apache Struts 2 Crafted Parameter Arbitrary OGNL Expression Remote Command Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2013-1966

high

Tenable Plugins

high

high

critical

high

high