New RCE Flaw in Apache Struts Discovered

PUBLISHED:
23 August 2018

New RCE Flaw in Apache Struts Discovered

Security researchers have discovered a critical remote code execution vulnerability in the popular Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers.

By exploiting this vulnerability, it is possible to perform an RCE attack when namespace value isn’t set for a result defined in underlying configurations and in the same time, its upper action(s) configurations have no or wildcard namespace. The same possibility when using url tag which doesn’t have value and action set and in the same time, its upper action(s) configurations have no or wildcard namespace.

Affected Versions

  • Struts 2.3 – Struts 2.3.34
  • Struts 2.5 – Struts 2.5.16
  • The unsupported Struts versions may be also affected.

Recommended Course of Action

Upgrade to Struts 2.3.35 or Struts 2.5.17

More Information

https://cwiki.apache.org/confluence/display/WW/S2-057

 

21 April 2022 [NO.TCSA : 20220422-1-1-P]

A Critical Unauthenticated Remote Code Execution (RCE) Flaw Found in WSO2 API Manager, Identity Server & Enterprise Integrator

READ MORE READ MORE
19 April 2022 [NO.TCSA : 20220419-1-1-P]

Possible Increase of Intrusion Attempts on Sri Lankan Websites

READ MORE READ MORE
1 April 2022 [NO.TCSA : 20220401-1-1-P]

Spring4Shell – A Critical Remote Execution Found Spring Framework

READ MORE READ MORE
Read More BACK TO THREAT BULLETIN