Detections
Analytics
Apache Struts CVE-2018-11776 Results With No Namespace Possible Remote Code Execution (S2-057)
high Nessus Plugin ID 112036
Language:
Synopsis
A web application running on the remote host uses a Java framework that is affected by a possible remote code execution.Description
The version of Apache Struts running on the remote host is 2.3.x prior to 2.3.35, or 2.5.x prior to 2.5.17. It, therefore, contains a possible remote code execution vulnerability when results are used without setting a namespace along with an upper action that does not have a namespace set or has a wildcard namespace set.Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Apache Struts version 2.3.35 or 2.5.17 or laterSee Also
https://cwiki.apache.org/confluence/display/WW/S2-057
https://seclists.org/bugtraq/2018/Aug/46
Plugin Details
Severity: High
ID: 112036
File Name: struts_2_5_17.nasl
Version: 1.16
Type: combined
Agent: windows, macosx, unix
Family: Misc.
Published: 8/22/2018
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2018-11776
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:struts
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/22/2018
Vulnerability Publication Date: 8/22/2018
CISA Known Exploited Vulnerability Due Dates: 5/3/2022
Exploitable With
Metasploit (Apache Struts 2 Namespace Redirect OGNL Injection)
Elliot (Apache Struts 2 Multiple Tags Result Namespace Handling RCE)
Reference Information
CVE: CVE-2018-11776
BID: 105125