Apache Struts 2.x < 220.127.116.11 Multiple Vulnerabilities
Critical Nessus Plugin ID 90773
SynopsisThe remote Windows host contains a web application that uses a Java framework that is affected by multiple vulnerabilities.
DescriptionThe version of Apache Struts running on the remote Windows host is 2.x prior to 18.104.22.168. It is, therefore, affected by the following vulnerabilities :
- An unspecified flaw exists, related to chained expressions, when Dynamic Method Invocation (DMI) is enabled. An unauthenticated, remote attacker can exploit this, via a crafted expression, to execute arbitrary code. (CVE-2016-3081)
- A flaw exists in XSLTResult due to a failure to sanitize user-supplied input to the 'location' parameter when determining the location of an uploaded stylesheet.
An unauthenticated, remote attacker can exploit this, via a request to a crafted stylesheet, to execute arbitrary code. (CVE-2016-3082)
- A flaw exists that is triggered when dynamic method invocation is enabled while using the REST plugin. A remote attacker can exploit this, via a specially crafted expression, to execute arbitrary code.
(CVE-2016-3087) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade to Apache Struts version 22.214.171.124 or later. Alternatively, apply the workarounds referenced in the vendor advisories.