SynopsisThe remote host contains a web application that uses a Java framework that is affected by multiple vulnerabilities.
DescriptionThe version of Apache Struts running on the remote host is 2.x prior to 184.108.40.206. It is, therefore, affected by the following vulnerabilities :
- An unspecified flaw exists, related to chained expressions, when Dynamic Method Invocation (DMI) is enabled. An unauthenticated, remote attacker can exploit this, via a crafted expression, to execute arbitrary code. (CVE-2016-3081)
- A flaw exists in XSLTResult due to a failure to sanitize user-supplied input to the 'location' parameter when determining the location of an uploaded stylesheet.
An unauthenticated, remote attacker can exploit this, via a request to a crafted stylesheet, to execute arbitrary code. (CVE-2016-3082)
- A flaw exists that is triggered when dynamic method invocation is enabled while using the REST plugin. A remote attacker can exploit this, via a specially crafted expression, to execute arbitrary code.
(CVE-2016-3087) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade to Apache Struts version 220.127.116.11 or later. Alternatively, apply the workarounds referenced in the vendor advisories.