Bug 1488482 (CVE-2017-9805)

Summary: CVE-2017-9805 struts: RCE attack via REST plugin with XStream handler to deserialise XML requests
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aileenc, bkearney, chazlett, dbhole, felias, ggainey, gvarsami, hchiorea, jcoleman, jolee, jshepherd, kconner, ldimaggi, loleary, meissner, mmraka, nbhumkar, nwallace, pavelp, psampaio, puntogil, rwagner, spinder, taw, tcunning, theute, thomas, tkirby, tlestach, vhalbert
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20170905,reported=20170905,source=internet,cvss3=8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H,cwe=CWE-20,rhel-5/struts=notaffected,rhn_satellite_5/struts=notaffected,fsw-6/struts=notaffected,jdv-6/struts=notaffected,jon-3/struts=notaffected,fedora-all/struts=notaffected,epel-7/struts=notaffected
Fixed In Version: struts 2.5.13 Doc Type: If docs needed, set a value
Doc Text:
The REST Plugin in Apache Struts2 is using a XStreamHandler with an instance of XStream for deserialization without any type filtering which could lead to Remote Code Execution when deserializing XML payloads. An attacker could use this flaw to execute arbitrary code or conduct further attacks.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-09-06 08:51:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1488487, 1488488    
Bug Blocks: 1488486    

Description Adam Mariš 2017-09-05 13:47:04 UTC
The REST Plugin is using a XStreamHandler with an instance of XStream for deserialization without any type filtering and this can lead to Remote Code Execution when deserializing XML payloads.

Affected versions:

Struts 2.5 - Struts 2.5.12

External References:

https://struts.apache.org/docs/s2-052.html

Comment 1 Adam Mariš 2017-09-05 14:01:34 UTC
Created struts tracking bugs for this issue:

Affects: epel-7 [bug 1488487]
Affects: fedora-all [bug 1488488]

Comment 2 Chess Hazlett 2017-09-05 18:28:35 UTC
Statement:

This issue did not affect any of the Red Hat products as they did not include the Apache Struts 2 package.