CVE-2017-5638

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications. 

‍

A Command Injection vulnerability (CVE-2017-5638) has been identified in Apache Struts, which allows an attacker to execute arbitrary commands through specially crafted HTTP headers, particularly exploiting a flaw in the file upload handling mechanism.

‍

Per OWASP: A Command Injection vulnerability is an attack where an attacker aims to execute arbitrary commands on the host operating system through a vulnerable application. These attacks occur when an application improperly passes untrusted user input (in this case HTTP headers) to a system shell. In such an attack, the commands provided by the attacker are typically executed with the same privileges as the vulnerable application. 

‍

This issue affects multiple versions, at 2.3.x before 2.3.32, at 2.5.x before 2.5.10.1

‍

Details

Module Info

• Product: Apache Struts 2
• Affected packages: struts-core
• Affected versions: >= 2.3.5 - <2.3.31, >=2.5 - <2.5.10
• GitHub repository: https://github.com/apache/struts
• Package manager: Maven
• Fixed in: Struts 2.3.32, Struts 2.5.10.1

‍

Vulnerability Info

The vulnerability occurred because some versions of Apache Struts were not correctly sanitizing user-controlled input in certain HTTP request headers. Exceptions and error messages were not handled securely during the processing of the file uploads. This vulnerability arose from a flaw in the Jakarta Multipart parser used in Apache Struts to handle file upload requests.  

‍

Mitigation

Users of the affected components should apply one of the following mitigations:

• Users of affected versions should upgrade to one of the patched versions: Struts 2.3.32, Struts 2.5.10.1
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• Lukasz Lenart - Apache Struts Security Bulletins