Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Path Traversal vulnerability (CVE-2023-49735) has been reported in Apache Struts, which allows attackers to manipulate input to cause a Denial of Service.
A Path Traversal vulnerability occurs when an attacker is able to manipulate file or directory paths in an application to gain unauthorized access to files or directories outside the intended directory. This typically happens when user input is not properly sanitized or validated, allowing attackers to use sequences like ../ to navigate the file system. The implications of a Path Traversal vulnerability are severe, as it can lead to unauthorized access to sensitive files, data leakage, system compromise, or further exploitation of the system, depending on the application’s privileges and access controls..
This issue affects multiple versions of Apache Struts Tiles.
Details
Module Info
- Product: Apache Struts
- Affected packages: struts, struts-tiles, tiles-core
- Affected versions: <1.3.10, >=2.0.0
- GitHub repository: https://github.com/apache/struts
- Package manager: Maven
- Fixed in: NES for Apache Struts Struts 1 v1.1.1, v1.3.12
Vulnerability Info
The DefaultLocaleResolver.LOCALE_KEY attribute on the session was not properly validated when resolving XML definition files. This oversight allowed for potential path traversal vulnerabilities, which could lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks when user-controlled data was passed to this key. This vulnerability was particularly concerning as the key was commonly used for setting the language in applications, such as the 'tiles-test' application bundled with Tiles, making the issue more prevalent in real-world scenarios.
Credit
- Joseph Beeton of Contrast Security
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade to patched version
Leverage a commercial support partner like HeroDevs for post-EOL security support.
