CVE-2014-0114: Arbitrary code execution in Apache Commons BeanUtils
Summary
CVE-2014-0114: Arbitrary code execution in Apache Commons BeanUtils. Affects commons-beanutils:commons-beanutils versions >= 1.8.0, < 1.9.4. Fixed in 1.9.4. How to fix ↓
Also tracked for
- commons-beanutils · Debian:11
The same CVE-2014-0114 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons BeanUtils is a Java library that provides utility methods for manipulating JavaBeans. It is widely used in various projects, including Apache Struts 1.x. The library allows developers to access and modify properties of Java objects using reflection. However, a vulnerability in versions prior to 1.9.2 allows remote attackers to execute arbitrary code by manipulating the ClassLoader through the 'class' parameter. This vulnerability was identified as CVE-2014-0114.
Vulnerability Detail
The vulnerability arises from the failure of Apache Commons BeanUtils to suppress the 'class' property. This allows attackers to manipulate the ClassLoader and execute arbitrary code by passing the 'class' parameter to the getClass method of the ActionForm object in Struts 1. The impact of this vulnerability can be severe, as it enables remote code execution, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
1.9.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually suppress the 'class' property in the affected code. This can be done by explicitly setting the 'class' property to null or by using input validation to ensure that the 'class' parameter does not contain malicious values.
Conclusion
The vulnerability in Apache Commons BeanUtils allows remote code execution, posing a significant risk to applications utilizing the library. It is crucial to upgrade to version 1.9.2 or later to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for commons-beanutils:commons-beanutils →
FAQ
Apache Commons BeanUtils is a Java library that provides utility methods for manipulating JavaBeans. It is commonly used in various projects to access and modify properties of Java objects using reflection.
The vulnerability allows remote attackers to execute arbitrary code by manipulating the ClassLoader through the 'class' parameter. This can lead to unauthorized access, data breaches, or system compromise.
Versions prior to 1.9.2 of Apache Commons BeanUtils are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Commons BeanUtils version 1.9.2 or later. This version includes a fix that properly suppresses the 'class' property.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually suppress the 'class' property in the affected code or validate the 'class' parameter to prevent malicious values.
References
Related vulnerabilities
Recent vulnerabilities recorded for commons-beanutils:commons-beanutils.
