CVE-2016-3090: Apache Struts RCE Vulnerability in org.apache.struts:struts2-core
Summary
CVE-2016-3090: Apache Struts RCE Vulnerability. Affects org.apache.struts:struts2-parent versions >= 2.0.0, < 2.3.20. Fixed in 2.3.20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. The struts2-core package is a core component of Apache Struts, providing various functionalities for web application development. This package is widely used in the Maven ecosystem. Unfortunately, it is susceptible to a remote code execution (RCE) vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3090, exists in the TextParseUtil.translateVariables method of Apache Struts 2.x before version 2.3.20. It allows remote attackers to execute arbitrary code by exploiting a crafted Object-Graph Navigation Language (OGNL) expression with ANTLR tooling. This vulnerability poses a significant risk as it enables attackers to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Minimum fixed version
2.3.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround can be implemented. It is advised to review and validate user input thoroughly, ensuring that no malicious OGNL expressions are processed. Additionally, implementing a web application firewall (WAF) can help detect and block potential attacks targeting this vulnerability.
Conclusion
The Apache Struts RCE vulnerability in the org.apache.struts:struts2-core package poses a significant risk to web applications utilizing this component. It is crucial to promptly address this vulnerability by upgrading to version 2.3.20 or later. If immediate upgrade is not possible, implementing temporary workarounds and ensuring input validation can help mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-parent →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides various features and components to simplify web application development.
The org.apache.struts:struts2-core package is a core component of Apache Struts. It offers essential functionalities for building web applications using the Struts framework.
A remote code execution vulnerability allows an attacker to execute arbitrary code on a target system remotely. This can lead to unauthorized access, data breaches, or further compromise of the system.
This vulnerability can be exploited by sending a crafted OGNL expression with ANTLR tooling to the vulnerable TextParseUtil.translateVariables method. If successful, the attacker can execute arbitrary code on the target system.
The consequences of this vulnerability can be severe. Attackers can gain unauthorized access to the system, compromise sensitive data, or perform malicious activities on the affected system.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-parent.
