CVE-2007-4556: OpenSymphony XWork Improper Input Validation
Summary
CVE-2007-4556: OpenSymphony XWork vulnerable to improper input validation. Affects opensymphony:xwork across 2 version ranges.
< 1.2.3
>= 2.0.0, < 2.0.4
Fixed in 1.2.3 or 2.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSymphony XWork is a command-pattern framework used to power WebWork and other applications. It provides functionality for handling web requests and executing actions based on those requests. XWork supports Object-Graph Navigation Language (OGNL) expressions, which allow developers to access and manipulate objects in the application. However, prior to versions 1.2.3 and 2.0.4, XWork had a vulnerability that allowed remote attackers to exploit improper input validation.
Vulnerability Detail
The vulnerability in OpenSymphony XWork occurs when the 'altSyntax' feature is enabled. In this configuration, XWork recursively evaluates all input as an OGNL expression. An attacker can exploit this by submitting form input that starts with a "%{" sequence and ends with a "}" character. This can lead to a denial of service (infinite loop) or even remote code execution. The vulnerability has a moderate severity rating and is classified under CWE-20.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.2.31.2.3 -
>= 2.0.0, < 2.0.42.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading to a fixed version is not immediately feasible, the 'altSyntax' feature can be disabled in the XWork configuration. This can be done by setting the 'struts.ognl.enableExpressionCache' property to 'false' in the struts.xml file. However, disabling this feature may impact the functionality of the application, so upgrading to a fixed version is still recommended.
Conclusion
OpenSymphony XWork prior to versions 1.2.3 and 2.0.4 is vulnerable to improper input validation, which can result in a denial of service or remote code execution. It is recommended to upgrade to a fixed version of XWork to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensymphony:xwork →
FAQ
OpenSymphony XWork is a command-pattern framework used to handle web requests and execute actions in web applications.
altSyntax is a feature in XWork that enables the use of Object-Graph Navigation Language (OGNL) expressions for accessing and manipulating objects.
OGNL is an expression language used in XWork to navigate and manipulate object graphs. It provides a concise syntax for accessing properties and invoking methods on objects.
This vulnerability can lead to a denial of service (infinite loop) or remote code execution, depending on the attacker's input.
To fix this vulnerability, you need to upgrade the XWork dependency in your project's Maven configuration file (pom.xml) to a fixed version.
