Red Hat Bugzilla – Bug 1116665
CVE-2014-3540 commons-beanutils: 'class' property is exposed, potentially leading to RCE
Last modified: 2014-10-20 20:06:59 EDT
It was found that commons-beanutils exposes the class property by default, with no mechanism to disable access to it. If a framework built on commons-beanutils does not otherwise suppress access to the class property, then a remote attacker could use this flaw to manipulate the ClassLoader used by the underlying container. This could lead to remote code execution under certain conditions.
MITRE has rejected this CVE ID, favoring the use of CVE-2014-0114.
This flaw was the root cause of CVE-2014-0114, a flaw in Apache Struts 1 that could lead to unauthenticated remote code execution under certains conditions. Other frameworks built on commons-beanutils, such as Apache Stripes, are likely to expose similar issues. commons-beanutils 1.9.2 has now shipped, including a specialized BeanIntrospector implementation that allows suppressing properties. Frameworks built on commons-beantutils can make use of the new pre-configured SuppressPropertiesBeanIntrospector to address this flaw.