A Vulnerability in Apache Struts Could Allow for Remote Code Execution

ITS Advisory Number: 
2020-161
Date(s) Issued: 
Tuesday, December 8, 2020
Subject: 
A Vulnerability in Apache Struts Could Allow for Remote Code Execution
Overview: 

A vulnerability has been discovered in Apache Struts, which could allow for remote code execution. Apache Struts is an open source framework used for building Java web applications. Successful exploitation of this vulnerability could allow for remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view; change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

 

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being exploited in the wild.

 

Systems Affected: 
  • Apache Struts versions prior to 2.5.26
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
Medium
BUSINESS
Large and medium business entities: 
High
Small business entities: 
Medium
Home Users: 
Low
Description: 

A vulnerability has been discovered in Apache Struts, which could allow for remote code execution. This vulnerability exists due to some of the tag attributes performing a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to remote code execution and security degradation. Successful exploitation of this vulnerability could allow for remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view; change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

 

Actions: 
  • Verify no unauthorized system modifications have occurred on the system before applying the patch.
  • After appropriate testing, immediately apply the upgrade to the most recent version of Apache Struts.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Frequently validate type and content of uploaded data.