A vulnerability has been discovered in Apache Struts, which could allow for remote code execution. Apache Struts is an open source framework used for building Java web applications. Successful exploitation of this vulnerability could allow for remote code execution. Depending on the privileges associated with the user, an attacker could then install programs; view; change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
SYSTEMS AFFECTED:
Government:
Businesses:
Home users: Low
TECHNICAL SUMMARY:
A vulnerability has been discovered in Apache Struts, which could allow for remote code execution. This vulnerability exists due to some of the tag attributes performing a double evaluation if a developer applied forced OGNL evaluation by using the %{…} syntax. Using forced OGNL evaluation on untrusted user input can lead to remote code execution and security degradation. Successful exploitation of the most severe of this vulnerability could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of this vulnerability could have less impact than if it was configured with administrative rights.
RECOMMENDATIONS:
We recommend the following actions be taken:
Verify no unauthorized system modifications have occurred on the system before applying the patch.
REFERENCES:
Apache:https://cwiki.apache.org/confluence/display/WW/S2-062
CVE:https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-31805
