Apache Struts 2.x < 2.3.20 Multiple ClassLoader Manipulation Vulnerabilities (S2-021)
high Nessus Plugin ID 117457
Language:
Synopsis
A web application running on the remote host uses a Java framework that is affected by multiple class loader vulnerabilities.Description
The version of Apache Struts running on the remote host is 2.x prior to to 2.3.20. It, therefore, is affected by multiple class loader vulnerabilities:- A class loader vulnerability exists in ParametersInterceptor due to improper access restriction to the getClass method. A remote, unauthenticated attacker can exploit this to manipulate the ClassLoader and execute arbitrary code. (CVE-2014-0112)
- A class loader vulnerability exists in CookieInterceptor due to improper access restriction to the getClass. A remote, unauthenticated attacker can exploit this, via a specially crafted request which uses a wildcard cookiesName value to manipulate the ClassLoader and execute arbitrary code. (CVE-2014-0113)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Apache Struts version 2.3.20 or laterSee Also
Plugin Details
Severity: High
ID: 117457
File Name: struts_2_3_16_2.nasl
Version: 1.12
Type: combined
Agent: windows, macosx, unix
Family: Misc.
Published: 9/12/2018
Updated: 4/11/2022
Supported Sensors: Nessus Agent
Risk Information
CVSS Score Source: CVE-2014-0113
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:F/RL:OF/RC:C
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:struts
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/24/2014
Vulnerability Publication Date: 4/24/2014
Exploitable With
Metasploit (Apache Struts ClassLoader Manipulation Remote Code Execution)
Elliot (Apache-Struts DefaultActionMapper < 2.3.15.1 RCE Linux)
Reference Information
CVE: CVE-2014-0112, CVE-2014-0113