Bug 967655 - (CVE-2013-1965) CVE-2013-1965 struts2: remote command execution in Showcase app
CVE-2013-1965 struts2: remote command execution in Showcase app
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20130522,repo...
: Security
Depends On:
Blocks: 967657
  Show dependency treegraph
 
Reported: 2013-05-27 16:09 EDT by Vincent Danen
Modified: 2013-05-27 21:57 EDT (History)
3 users (show)

See Also:
Fixed In Version: Struts 2.3.14.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-05-27 21:57:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2013-05-27 16:09:23 EDT
As per the upstream report:

OGNL provides, among other features, extensive expression evaluation capabilities. 
A request that included a specially crafted request parameter could be used to inject arbitrary OGNL code into a property, afterward used as request parameter of a redirect address, which will cause a further evaluation.

OGNL evaluation was already addressed in S2-003 and S2-005 and S2-009, but, since it involved just the parameter's name, it turned out that the resulting fixes based on whitelisting acceptable parameter names and denying evaluation of the expression contained in parameter names, closed the vulnerability only partially.

The second evaluation happens when redirect result reads it from the stack and uses the previously injected code as redirect parameter.
This lets malicious users put arbitrary OGNL statements into any unsanitized String variable exposed by an action and have it evaluated as an OGNL expression to enable method execution and execute arbitrary methods, bypassing Struts and OGNL library protections.


This flaw is reported to affect Struts 2.0.0 through to Struts 2.3.14.  It is corrected in 2.3.14.1.


External References:

https://cwiki.apache.org/confluence/display/WW/S2-012
Comment 1 Arun Babu Neelicattu 2013-05-27 21:57:31 EDT
Statement:

Not Vulnerable. This issue only affects struts 2, it does not affect the
versions of struts as shipped with various Red Hat products.

Note You need to log in before you can comment on or make changes to this bug.