CVE-2014-0094: Medium severity Apache struts vulnerability
It was found that the Struts 2 ParametersInterceptor allows access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by the application server running Struts 2. This could lead to arbitrary remote code execution under certain conditions.
This flaw is reported to affect Struts 2.0.0 through to Struts 2.3.16. It is corrected in 2.3.16.1.
External References:
https://cwiki.apache.org/confluence/display/WW/S2-020
Other sources
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Strutsto a version that resolves this vulnerability.Fixed in 2.3.16.2 - Upgrade
Upgrade
maven/org.apache.struts.xwork:xwork-coreto a version that resolves this vulnerability.Fixed in 2.3.16.2 - Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.3.16.2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0094?
CVE-2014-0094 is classified as a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2014-0094?
To fix CVE-2014-0094, upgrade Apache Struts to version 2.3.16.2 or later.
What causes CVE-2014-0094?
CVE-2014-0094 is caused by improper handling of the class parameter in the ParametersInterceptor component of Apache Struts.
What systems are affected by CVE-2014-0094?
CVE-2014-0094 affects all versions of Apache Struts prior to 2.3.16.2.
How can I determine if my application is vulnerable to CVE-2014-0094?
You can determine if your application is vulnerable to CVE-2014-0094 by checking if it is running an affected version of Apache Struts before 2.3.16.2.