Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted
    request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
    NOTE: this issue is due to an incomplete fix for CVE-2013-1966. (CVE-2013-2115)

The version of Apache Struts running on the remote host is 2.x prior to 2.3.14.2. It, therefore, is affected by multiple vulnerabilities including a remote command execution vulnerability and a cross-site scripting (XSS) vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web application appears to use Struts 2, a web framework that utilizes OGNL (Object-Graph Navigation Language) as an expression language. Due to a flaw in the evaluation of an OGNL expression, a remote, unauthenticated attacker can exploit this issue to execute arbitrary commands on the remote web server by sending a specially crafted HTTP request. 

Note this issue exists because of an incomplete fix for CVE-2013-1966. 

Note that this version of Struts 2 is reportedly also affected by multiple cross-site scripting (XSS) vulnerabilities as well as session access and manipulation attacks; however, Nessus has not tested for these issues. 

Note that this plugin will only report the first vulnerable instance of a Struts 2 application.

ID	Name	Product	Family	Type	Severity
412056	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-7ghm-rpc7-p7g5)	Tenable Cloud Security	SCA Checks	Local	high
412056	SCA: security update for org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core (GHSA-7ghm-rpc7-p7g5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
117364	Apache Struts 2.x < 2.3.14.2 Multiple Vulnerabilities (S2-014)	Nessus	Misc.	Combined	high
66935	Apache Struts 2 Crafted Parameter Arbitrary OGNL Expression Remote Command Execution	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2013-2115

high

Tenable Plugins

high

high

high

high