Summary
Use of a JRE with broken URLDecoder implementation may lead to XSS vulnerability in Struts 2 based web applications.Who should read this | All Struts 2 developers and users |
|---|---|
Impact of vulnerability | Affects of a cross-site scripting vulnerability. |
Maximum security rating | Medium |
Recommendation | Ugrade runtime JRE to a recent major version, preferably 1.8. Alternatively upgrade to Struts 2.3.25 |
Affected Software | Struts 2.0.0 - Struts Struts 2.3.24.1 |
Reporter | WhiteHat Security (whitehatsec.com) |
CVE Identifier | - |
Problem
ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings
Solution
Applying better regex which includes pattern to exclude request parameters trying to use top object. We recommend upgrading to Struts 2.3.24.1.
Backward compatibility
If an application is using parameter named top to access action's properties, it won't be set on the action. In other case no backward compatibility problems are expected.
Workaround
Applying the below patterns will solve the problem as well:
"(^|\\%\\{)((#?)(top(\\.|\\['|\\[\")|\\[\\d\\]\\.)?)(dojo|struts|session|request|response|application|servlet(Request|Response|Context)|parameters|context|_memberAccess)(\\.|\\[).*",
"^(action|method):.*"