The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary
    code via a crafted expression. (CVE-2016-4438)

The version of Apache Struts running on the remote Windows host is 2.x prior to 2.3.29. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to     erroneously performing double OGNL evaluation of     attribute values assigned to certain tags. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-0785)

  - A cross-site request forgery (XSRF) vulnerability exists     due to improper validation of session tokens. An     unauthenticated, remote attacker can exploit this, via a     malicious OGNL expression, to bypass token validation     and perform an XSRF attack. (CVE-2016-4430)

  - Multiple input validation issues exists that allow     internal security mechanisms to be bypassed, allowing     the manipulation of a return string which can be used to     redirect users to a malicious website. This affects both     the default action method the 'getter' action method.
    (CVE-2016-4431, CVE-2016-4433)

  - An unspecified flaw exists that is triggered during the     cleanup of action names. An unauthenticated, remote     attacker can exploit this, via a specially crafted     payload, to perform unspecified actions. (CVE-2016-4436)

  - A remote code execution vulnerability exists in the REST     plugin due to improper handling of OGNL expressions. An     unauthenticated, remote attacker can exploit this, via     a specially crafted OGNL expression, to execute     arbitrary code. (CVE-2016-4438)

  - A remote code execution vulnerability exists in user tag     attributes due to improper handling of OGNL expressions.     An unauthenticated, remote attacker can exploit this,     via a specially crafted double OGNL evaluation, to     execute arbitrary code. (CVE-2016-4461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote web application appears to use Apache Struts 2, a web framework that utilizes OGNL (Object-Graph Navigation Language) as an expression language. A remote code execution vulnerability exists in the REST plugin due to improper handling of OGNL expressions. An unauthenticated, remote attacker can exploit this, via a specially crafted OGNL expression, to execute arbitrary code.

Note that this plugin only reports the first vulnerable instance of a Struts 2 application.

ID	Name	Product	Family	Severity
410322	SCA: security update for org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin (GHSA-4prj-vw9j-v6pr)	Tenable Cloud Security	SCA Checks	critical
410322	SCA: security update for org.apache.struts:struts2-core, org.apache.struts:struts2-rest-plugin (GHSA-4prj-vw9j-v6pr)	Tenable Self-Hosted Container Security	SCA Checks	critical
91812	Apache Struts 2.x < 2.3.29 Multiple Vulnerabilities (S2-035 - S2-040)	Nessus	Misc.	high
91811	Apache Struts 2 REST Plugin OGNL Expression Handling RCE	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2016-4438

critical

Tenable Plugins

critical

critical

high

critical