Child pages
  • S2-029

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution vulnerability

Maximum security rating

Important

Recommendation

Always validate incoming parameters' values when re-assigning them to certain Struts' tags attributes.

Don't use %{...} syntax in tag attributes other than value unless you have a valid use-case.

Alternatively upgrade to Struts 2.3.20.3, Struts 2.3.24.3 or Struts 2.3.28

Affected Software

Struts 2.0.0 - StrutsStruts 2.3.24.1 (except 2.3.20.3)

Reporters

Romain Gaucher rgaucher at coverity dot com - Coverity

Lupin lupin1314 at gmail dot com - jd.com security team

nike.zheng at dbappsecurity dot com dot cn - dbappsecurity team

genxors at gmail dot com - Qihoo 360 SkyEye Lab

CVE Identifier

CVE-2016-0785

...

By upgrading to Struts 2.3.20.3, 2.3.24.3 and 2.3.28, possible malicious effects of forced double evaluation are limited.

...

No issues expected when upgrading to Struts 2.3.20.3, 2.3.24.3 and 2.3.28

Workaround

If you are using Struts 2.3.20, 2.3.24 or 2.3.24.1 you can redefine struts.excludedClasses as showed below, for more details please read internal security page.

...