Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.4.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 18 proofs of concept on GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Timeline
- CVE published5 days
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
18 days - Record last updated663 days (about 2 years)
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- org.apache.struts:struts2-core
From 2.0.0 · fixed in 6.4.0
- org.apache.struts:struts2-coreMaven
fixed in 6.4.0