CVE-2015-0899: Improper Input Validation in Apache Struts
Summary
CVE-2015-0899: Improper Input Validation in Apache Struts. Affects org.apache.struts:struts-core versions >= 1.1, <= 1.3.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The Apache Struts struts-core package is a core component of the framework, responsible for handling requests, managing actions, and rendering views. This vulnerability affects versions 1.1 through 1.3.10 of the struts-core package.
Vulnerability Detail
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 suffers from an improper input validation vulnerability. Remote attackers can bypass intended access restrictions by modifying the page parameter. This vulnerability can lead to unauthorized access to sensitive information or functionality, potentially resulting in data breaches or privilege escalation attacks. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing the page parameter manually in the application code. This can be done by implementing proper input validation and filtering techniques, such as whitelisting allowed values or using regular expressions to ensure the parameter's integrity. Here is an example of how to sanitize the page parameter in Java:
String sanitizedPage = page.replaceAll("[^a-zA-Z0-9]", "");
Conclusion
The Apache Struts struts-core package is vulnerable to an improper input validation issue, which can be exploited by remote attackers to bypass access restrictions. It is crucial to upgrade to a patched version of the package (1.3.11 or later) and review any custom code or configurations that rely on the vulnerable functionality. Implementing proper input validation and filtering techniques can provide a temporary workaround until the upgrade is performed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
This vulnerability allows remote attackers to bypass access restrictions and potentially gain unauthorized access to sensitive information or functionality. It can lead to data breaches or privilege escalation attacks.
Versions 1.1 through 1.3.10 of the Apache Struts struts-core package are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a patched version of the Apache Struts struts-core package (version 1.3.11 or later). Additionally, developers should review and update any custom code or configurations that rely on the vulnerable functionality.
Yes, if upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the page parameter in the application code.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts-core.
