Summary

Apache Struts is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the URLDecoder implementation. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

Affected Products and Versions

Platform Cluster Manager Standard Edition Version 4.1.0, 4.1.1 and 4.1.1.1
Platform Cluster Manager Advanced Edition Version 4.2.0, 4.2.0.1, 4.2.0.2 and 4.2.1
Platform HPC Version 4.1.1, 4.1.1.1, 4.2.0 and 4.2.1

Remediation/Fixes

See workarounds

Workarounds and Mitigations

Platform Cluster Manager 4.2.1 & Platform HPC 4.2.1

1. Download the struts-2.3.28-lib.zip package from the following location: http://archive.apache.org/dist/struts/2.3.28/

2. Copy the struts-2.3.28-lib.zip package to the management node.

3. Extract the struts-2.3.28-lib.zip package on the management node.

unzip struts-2.3.28-lib.zip # cd struts-2.3.28/lib # cp xwork-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib# cp struts2-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib# cp struts2-jasperreports-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib# cp struts2-json-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib# cp struts2-spring-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib# cp freemarker-2.3.22.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib

cp ognl-3.0.13.jar /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib

mkdir -p /root/backup

mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/struts2-core-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/struts2-json-plugin-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/struts2-spring-plugin-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/xwork-core-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/freemarker-2.3.18.jar /root/backup

mv /opt/pcm/web-portal/gui/3.0/wlp/usr/servers/platform/apps/platform.war/WEB-INF/lib/ognl-3.0.6.jar /root/backup

4. Restart Platform HPC services. If high availability is enabled, run the following commands on the active management node:

pcmhatool failmode -m manual # pcmadmin service stop --service WEBGUI# pcmadmin service start --service WEBGUI# pcmhatool failmode -m auto

Otherwise, if high availability is not enabled, run the following commands on the management node:

pcmadmin service stop --service WEBGUI# pcmadmin service start --service WEBGUI

Platform Cluster Manager 4.2.0 4.2.0.x & Platform HPC 4.2.0 4.2.0.x

1. Download the struts-2.3.28-lib.zip package from the following location: http://archive.apache.org/dist/struts/2.3.28/

2. Copy the struts-2.3.28-lib.zip package to the management node.

3. Extract the struts-2.3.28-lib.zip package on the management node.

unzip struts-2.3.28-lib.zip # cd struts-2.3.28/lib # cp xwork-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-jasperreports-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-json-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-spring-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp freemarker-2.3.22.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib

cp ognl-3.0.13.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib

mkdir -p /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-core-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-json-plugin-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-spring-plugin-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/xwork-core-2.3.16.3.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/freemarker-2.3.18.jar /root/backup

mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/ognl-3.0.6.jar /root/backup

4. Restart Platform HPC services. If high availability is enabled, run the following commands on the active management node:

pcmhatool failmode -m manual # pcmadmin service stop --service WEBGUI# pcmadmin service start --service WEBGUI# pcmhatool failmode -m auto

Otherwise, if high availability is not enabled, run the following commands on the management node:

pcmadmin service stop --service WEBGUI# pcmadmin service start --service WEBGUI

Platform Cluster Manager 4.1.x & Platform HPC 4.1.x

1. Download the struts-2.3.28-lib.zip package from the following location: http://archive.apache.org/dist/struts/2.3.28/

2. Copy the struts-2.3.28-lib.zip package to the management node.

3. Extract the struts-2.3.28-lib.zip package on the management node

unzip struts-2.3.28-lib.zip # cd struts-2.3.28/lib/ # cp xwork-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-core-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-json-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-spring-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp freemarker-2.3.22.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib# cp struts2-jasperreports-plugin-2.3.28.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib

cp ognl-3.0.13.jar /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib

mkdir -p /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-core-2.3.15.2.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-json-plugin-2.3.15.2.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/struts2-spring-plugin-2.3.15.2.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/xwork-core-2.3.15.2.jar /root/backup# mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/freemarker-2.3.18.jar /root/backup

mv /opt/pcm/web-portal/gui/3.0/tomcat/webapps/platform/WEB-INF/lib/ognl-3.0.6.jar /root/backup

4. Restart Platform HPC services. If high availability is enabled, run the following commands on the active management node:

pcmhatool failmode -m manual # pmcadmin stop# pmcadmin start# pcmhatool failmode -m auto

Otherwise, if high availability is not enabled, run the following commands on the management node:

pmcadmin stop

pmcadmin start