Apache Struts Users Told to Update Vulnerable Component
7.11.2018 securityweek  Vulnerebility

Apache Struts developers are urging users to update a file upload library due to the existence of two vulnerabilities that can be exploited for remote code execution and denial-of-service (DoS) attacks.

The team behind the open source development framework pointed out that the Commons FileUpload library, which is the default file upload mechanism in Struts 2, is affected by a critical remote code execution vulnerability.

The flaw, tracked as CVE-2016-1000031, was discovered by Tenable researchers back in 2016. It was patched with the release of Commons FileUpload version 1.3.3 in June 2017.

“There exists a Java Object in the Apache Commons FileUpload library that can be manipulated in such a way that when it is deserialized, it can write or copy files to disk in arbitrary locations. Furthermore, while the Object can be used alone, this new vector can be integrated with ysoserial to upload and execute binaries in a single deserialization call,” Tenable said when it disclosed the security bug.

Struts versions after 2.5.12 are already using version 1.3.3 of the library, but applications using Struts 2.3.36 and earlier need to update the library manually by replacing the commons-fileupload JAR file in WEB-INF/lib with the patched version.

Version 1.3.3 of the Commons FileUpload library also includes a fix for a less severe DoS vulnerability discovered in 2014 and tracked as CVE-2014-0050.

Malicious actors could exploit this flaw to launch DoS attacks on publicly accessible sites, Apache Struts developers warned. This vulnerability was first patched in February 2014 with the release of version 1.3.1.

Johannes Ullrich, dean of research at the SANS Technology Institute, also advised users to check for other copies of the library on their system since Struts is not the only one using it.

It’s not uncommon for malicious hackers to exploit Apache Struts vulnerabilities in their attacks, even one year after they have been patched.

One recent example involves CVE-2018-11776, an easy-to-exploit bug that cybercriminals have exploited to deliver cryptocurrency miners.