{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2017-017.pdf" }, "title": "Remote Code Execution Attack Against Apache Struts REST Plugin", "serial_number": "2017-017", "publish_date": "07-09-2017 14:47:00", "description": "On August 16th 2017, a new vulnerability affecting Apache Struts 2 (CVE-2017-9805) was published. This vulnerability allows remote code execution attacks, when the Struts REST plugin is used with XStreamHandler to handle XML payloads. It is important to note that the code that exploits the vulnerability has been released through Metasploit.", "url_title": "2017-017", "content_markdown": "---\ntitle: 'Remote Code Execution Attack Against\u00a0Apache Struts REST Plugin'\nversion: '1.0'\nnumber: '2017-017'\nfontsize: '11pt'\n---\n\n_History:_\n\n* _07/09/2017 --- v1.0 -- Initial publication_\n\n\n# Summary\n\nOn August 16th 2017, a new vulnerability affecting Apache Struts 2 (CVE-2017-9805) was published. Struts is a framework following the MVC model under Java working in Apache servers. This open-source framework is widely used to built web applications [1].\n\nThis vulnerability allows remote code execution attacks, when the Struts REST plugin is used with `XStreamHandler` to handle XML payloads. The problems is due to the lack of filters in the `XStreamHandler` when deserializing XML payloads.\n\nIt is important to note that the code that exploits the vulnerability has been released through Metasploit [2].\n\n# Products Affected\n\n* Struts 2.1.2 - Struts 2.3.33,\n* Struts 2.5 - Struts 2.5.12.\n\n# Recommendations\n\nFix is available through an upgrade to Apache Struts version 2.3.34 or 2.5.13.\n\nIt is important to take in consideration that this upgrade might require changes in the code of the applications supported by the plugin. It is recommended to follow the backward compatibility notes in the original Apache advisory [1].\n\nAs workarounds to consider:\n\n1. Removing the Struts REST plugin, when not used.\n\n2. Limiting the plugin to server normal pages and JSONs only. In order to do that proceed as follows:\n\n\t* Disable handling of XML pages and requests to such pages\n```js\n\n```\n\t* Override `getContentType` in `XStreamHandler`\n```js\n\tpublic class MyXStreamHandler extends XStreamHandler { public String getContentType() {\n \t return \"not-existing-content-type-@;/&%$#@\";\n \t }\n\t}\n```\n\t* Register the handler by overriding the one provided by the framework in your `struts.xml`\n```js\n\t\n\t\n```\n\n# References\n\n[1] \n\n[2] \n", "content_html": "

History:

  • 07/09/2017 --- v1.0 -- Initial publication

Summary

On August 16th 2017, a new vulnerability affecting Apache Struts 2 (CVE-2017-9805) was published. Struts is a framework following the MVC model under Java working in Apache servers. This open-source framework is widely used to built web applications [1].

This vulnerability allows remote code execution attacks, when the Struts REST plugin is used with XStreamHandler to handle XML payloads. The problems is due to the lack of filters in the XStreamHandler when deserializing XML payloads.

It is important to note that the code that exploits the vulnerability has been released through Metasploit [2].

Products Affected

  • Struts 2.1.2 - Struts 2.3.33,
  • Struts 2.5 - Struts 2.5.12.

Recommendations

Fix is available through an upgrade to Apache Struts version 2.3.34 or 2.5.13.

It is important to take in consideration that this upgrade might require changes in the code of the applications supported by the plugin. It is recommended to follow the backward compatibility notes in the original Apache advisory [1].

As workarounds to consider:

  1. Removing the Struts REST plugin, when not used.

  2. Limiting the plugin to server normal pages and JSONs only. In order to do that proceed as follows:

    • Disable handling of XML pages and requests to such pages
<constant name="struts.action.extension" value="xhtml,,json" />\n
* Override `getContentType` in `XStreamHandler`\n
    public class MyXStreamHandler extends XStreamHandler { public String getContentType() {\n     return "not-existing-content-type-@;/&%$#@";\n     }\n    }\n
* Register the handler by overriding the one provided by the framework in your `struts.xml`\n
    <bean type="org.apache.struts2.rest.handler.ContentTypeHandler" name="myXStreamHandmer" class="com.company.MyXStreamHandler"/>\n    <constant name="struts.rest.handlerOverride.xml" value="myXStreamHandler"/>\n

References

[1] https://cwiki.apache.org/confluence/display/WW/S2-052

[2] https://github.com/rapid7/metasploit-framework/pull/8924

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }