Apache published two security bulletins to address a potential remote code execution vulnerability and a denial of service vulnerability. Public proof of concept code is available. Background On August 13, Apache published security bulletins to address two vulnerabilities in Apache Struts version 2. Apache Struts is an open source model-view-controller (MVC) framework used to create Java web applications.

CVE-2019-0230: Apache Struts Potential Remote Code Execution Vulnerability

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag
    attributes, may lead to remote code execution. (CVE-2019-0230)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K35226442 advisory.

  - An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when     performing a file upload. (CVE-2019-0233)

  - Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag     attributes, may lead to remote code execution. (CVE-2019-0230)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Struts installed on the remote host is 2.x prior or equal to 2.5.20. It is, therefore, affected by multiple vulnerabilities:

  - The Apache Struts frameworks, when forced, performs double evaluation of attributes' values assigned to     certain tags attributes such as id so it is possible to pass in a value that will be evaluated again when     a tag's attributes will be rendered. With a carefully crafted request, this can lead to Remote Code     Execution (RCE). The problem only applies when forcing OGNL evaluation inside a Struts tag attribute, when     the expression to evaluate references raw, unvalidated input that an attacker is able to directly modify     by crafting a corresponding request.Example:List available EmployeesIf an attacker is able to modify the     skillName attribute in a request such that a raw OGNL expression gets passed to the skillName property     without further validation, the provided OGNL expression contained in the skillName attribute gets     evaluated when the tag is rendered as a result of the request.The opportunity for using double evaluation     is by design in Struts since 2.0.0 and a useful tool when done right, which most notably means only     referencing validated values in the given expression. However, when referencing unvalidated user input in     the expression, malicious code can get injected. In an ongoing effort, the Struts framework includes     mitigations for limiting the impact of injected expressions, but Struts before 2.5.22 left an attack     vector open which is addressed by this report. This issue is similar to: S2-029 and S2-036. (CVE-2019-0230)

  - When a file upload is performed to an Action that exposes the file with a getter, an attacker may     manipulate the request such that the working copy of the uploaded file is set to read-only. As a result,     subsequent actions on the file will fail with an error. It might also be possible to set the Servlet     container's temp directory to read only, such that subsequent upload actions will fail. In Struts prior     to 2.5.22, stack-accessible values (e.g. Action properties) of type java.io.File and java.nio.File as well     as other classes from these standard library packages are not properly protected by the framework to deny     access to potentially harmful underlying properties. (CVE-2019-0233)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
420024	SCA: security update for org.apache.struts:struts2-core (GHSA-wp4h-pvgw-5727)	Tenable Cloud Security	SCA Checks	critical
420024	SCA: security update for org.apache.struts:struts2-core (GHSA-wp4h-pvgw-5727)	Tenable Self-Hosted Container Security	SCA Checks	critical
184328	F5 Networks BIG-IP : Apache Struts vulnerabilities (K35226442)	Nessus	F5 Networks Local Security Checks	critical
112766	Apache Struts 2.x < 2.5.22 Remote Code Execution (S2-059)	Web App Scanning	Component Vulnerability	critical
139607	Apache Struts 2.x <= 2.5.20 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2019-0230

critical

Tenable Plugins

critical

critical

critical

critical

critical