Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation
    is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained
    expressions. (CVE-2016-3081)

The remote web application appears to use Struts 2, a web framework that utilizes OGNL (Object-Graph Navigation Language) as an expression language. When Dynamic Method Invocation is enabled, it is possible to pass a malicious expression to the 'method:' prefix. A remote, unauthenticated attacker can exploit this issue to execute arbitrary commands on the remote web server.

Note that this plugin will only report the first vulnerable instance of a Struts 2 application.

The version of Apache Struts running on the remote host is 2.x prior to 2.3.28.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists, related to chained     expressions, when Dynamic Method Invocation (DMI) is     enabled. An unauthenticated, remote attacker can exploit     this, via a crafted expression, to execute arbitrary     code. (CVE-2016-3081)

  - A flaw exists in XSLTResult due to a failure to     sanitize user-supplied input to the 'location' parameter     when determining the location of an uploaded stylesheet.
    An unauthenticated, remote attacker can exploit this,     via a request to a crafted stylesheet, to execute     arbitrary code. (CVE-2016-3082)

  - A flaw exists that is triggered when dynamic method     invocation is enabled while using the REST plugin. A     remote attacker can exploit this, via a specially     crafted expression, to execute arbitrary code.
    (CVE-2016-3087)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
432936	SCA: security update for org.apache.struts:struts2-core (GHSA-8c6j-ffmf-q6vm)	Tenable Cloud Security	SCA Checks	high
432936	SCA: security update for org.apache.struts:struts2-core (GHSA-8c6j-ffmf-q6vm)	Tenable Self-Hosted Container Security	SCA Checks	high
119728	Apache Struts 2 'method:' Prefix Arbitrary Remote Command Execution	Nessus	CGI abuses	high
90773	Apache Struts 2.x < 2.3.28.1 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2016-3081

high

Tenable Plugins

high

high

high

critical