Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Cross-Site scripting (XSS) vulnerability (CVE-2005-3745) has been identified in Apache Struts, which allows attackers to inject malicious HTML on invalid paths.
Per OWASP: Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. An attacker can use XSS to send a malicious script to an unsuspecting user.
This issue affects struts versions below 1.2.8.
Details
Module Info
- Product: Apache Struts 1
- Affected packages: struts
- Affected versions: <=1.2.7
- GitHub repository: https://github.com/apache/struts1
- Package manager: Maven
- Fixed in: NES for Struts Struts 1 v1.1.2
Vulnerability Info
Apache Struts 1.x versions up to and including 1.2.7 include an invalid URL in the bad request response. On certain application servers, this response is not properly escaped, which can lead to an XSS attack. Vulnerable versions of Struts running on Resin Web Server, WebLogic 8.1 SP4, and WebLogic 8.1 SP5 are affected, while Struts running on Apache Tomcat are not.
Mitigation
Struts 1 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Struts.
Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Irene Abezgauz
