Apache Struts 2 Struts 1 plugin Showcase OGNL code execution

Added: 06/06/2018
CVE: CVE-2017-9791
BID: 99484

Background

Apache Struts is an open-source web application framework for developing Java EE web applications. The Struts 1 plugin allows developers to use Struts 1 Actions and ActionForms in Struts 2 applications. The Showcase application is an example application in the Struts 1 plugin.

Problem

The Showcase application in the Struts 1 plugin allows a remote attacker to inject commands within OGNL code, resulting in arbitrary command execution.

Resolution

Remove the Struts 1 plugin and/or the Showcase example application if it is not needed.

Always use resource keys instead of passing a raw messages to the ActionMessage. Never pass a raw value directly.

References

<https://cwiki.apache.org/confluence/display/WW/S2-048&gt;

Platforms

Linux