CVE-2014-0112: High severity Apache struts vulnerability
It was found that the fix for CVE-2014-0094 was incomplete. The Struts 2 ParametersInterceptor was updated to block access to the 'class' parameter, but not all forms in which this parameter can be specified were blocked. A remote attacker could use this flaw to manipulate the ClassLoader used by the application server running Struts 2. This could lead to arbitrary remote code execution under certain conditions.
This flaw is reported to affect Struts 2.0.0 through to Struts 2.3.16.1. It is corrected in 2.3.16.2.
External References:
https://cwiki.apache.org/confluence/display/WW/S2-021
Other sources
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.3.20 - Upgrade
Upgrade
redhat/Strutsto a version that resolves this vulnerability.Fixed in 2.3.16.2 - Upgrade
Upgrade
Apache Struts 2to a version that resolves this vulnerability.Fixed in 2.3.16.2 - Upgrade
Upgrade
Apache Struts 2to a version that resolves this vulnerability.Fixed in 2.3.20 - Configuration
Update Struts 2 ParametersInterceptor to fully block access to the getClass/class parameter (not only one form) to prevent remote manipulation of the ClassLoader and potential arbitrary remote code execution.
Apache Struts 2 ParametersInterceptor access restriction for getClass/class parameter = block access to the 'class' parameter in all supported forms
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0112?
CVE-2014-0112 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2014-0112?
To fix CVE-2014-0112, update Apache Struts to version 2.3.20 or later.
Which versions of Apache Struts are affected by CVE-2014-0112?
CVE-2014-0112 affects Apache Struts versions from 2.0.0 up to but not including 2.3.20.
What type of vulnerability is CVE-2014-0112?
CVE-2014-0112 is a security vulnerability that allows remote code execution due to improper access restrictions.
Can CVE-2014-0112 be exploited remotely?
Yes, CVE-2014-0112 can be exploited remotely through crafted HTTP requests.