Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Cross-site scripting (XSS) vulnerability (CVE-2006-1548) has been identified in Apache Struts, which allows attackers to inject arbitrary web script or HTML.
Per OWASP, Cross Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
This issue affects all versions of Struts less than 1.2.9.
Details
Module Info
- Product: Apache Struts
- Affected packages: struts, struts-core
- Affected versions: <1.2.9
- GitHub repository: https://github.com/apache/struts
- Package manager: Maven
- Fixed in: NES for Apache Struts Struts 1 v1.1.1
Vulnerability Info
A Cross-Site Scripting (XSS) vulnerability was identified in several components of Apache Struts, including DispatchAction, ActionDispatcher, and LookupDispatchAction. These components were improperly handling user-supplied input when generating error messages for invalid parameters. Specifically, user input was being reflected back in exception messages without appropriate filtering or escaping, which created an opening for attackers to inject malicious scripts or HTML into the response.
This vulnerability could allow remote attackers to execute arbitrary web scripts in the context of the affected application, potentially leading to session hijacking, defacement, or theft of sensitive information.
To address the issue, the affected Struts components were updated so that user input is no longer included in error messages, effectively closing this XSS attack vector.
Credit
- Tommy Wareing
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade to patched version 1.2.9
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
