Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2020.2803 Two new vulnerabilities found in Apache Struts, already fixed in current version 14 August 2020 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Apache Struts Publisher: Apache Operating System: Windows UNIX variants (UNIX, Linux, OSX) Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-0233 CVE-2019-0230 Original Bulletin: https://struts.apache.org/announce.html#a20200813 Comment: Apache note that these newly-discovered vulnerabilities do not affect the current version, 2.5.22, released in November 2019. Members using previous versions of Struts, v2.0.0 to 2.5.20, will wish to patch. - --------------------------BEGIN INCLUDED TEXT-------------------- Two new Struts Security Bulletins have been issued for Struts 2 by the Apache Struts Security Team: [1] S2-059 - Forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution (CVE-2019-0230) [2] S2-060 - Access permission override causing a Denial of Service when performing a file upload (CVE-2019-0233) [3] Both issues affect Apache Struts in the version range 2.0.0 - 2.5.20. The current version 2.5.22, which was released in November 2019, is not affected. CVE-2019-0230 has been reported by Matthias Kaiser, Apple Information Security. By design, Struts 2 allows developers to utilize forced double evaluation for certain tag attributes. When used with unvalidated, user modifiable input, malicious OGNL expressions may be injected. In an ongoing effort, the Struts framework includes mitigations for limiting the impact of injected expressions, but Struts before 2.5.22 left an attack vector open which is addressed by this report. [2] However, we continue to urge developers building upon Struts 2 to not use %{...} syntax referencing unvalidated user modifiable input in tag attributes, since this is the ultimate fix for this class of vulnerabilities. [4] CVE-2019-0233 has been reported by Takeshi Terada of Mitsui Bussan Secure Directions, Inc. In Struts before 2.5.22, when a file upload is performed to an Action that exposes the file with a getter, an attacker may manipulate the request such that the working copy of the uploaded file or even the container temporary upload directory may be set to read-only access. As a result, subsequent actions on the file or file uploads in general will fail with an error. [3] Both issues are already fixed in Apache Struts 2.5.22, which was released in November 2019. We strongly recommend all users to upgrade to Struts 2.5.22, if this has not been done already. [5][6] The Apache Struts Security Team would like to thank the reporters for their efforts and their practice of responsible disclosure, as well as their help while investigating the report and coordinating public disclosure. [1] https://struts.apache.org/announce.html#a20200813 [2] https://cwiki.apache.org/confluence/display/ww/s2-059 [3] https://cwiki.apache.org/confluence/display/ww/s2-060 [4] https://struts.apache.org/security/#use-struts-tags-instead-of-raw-el-expressions [5] https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.22 [6] https://struts.apache.org/download.cgi#struts-ga - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXzXlU+NLKJtyKPYoAQjDEhAAiRxQpT/uKqjoXDtVNOxH1u2yCQSFGdaA 3CCgHAgXNh483rGA7kFHztQAO0NJTJnK4muCPlpQqrq0nc9gU8E5Oy1eNToHrEod 1O/XiIaqz565Ic8fGdNrATeOj/fNWaorcImIU7kO5/liNj9dFSqu+pteeU57dv2u tDL4yhiIXC0eOqjDUvCpTkXNkpPBAnv/R9r7C9pcA4mxNBvf8B6D2fJfuXPqbvCx PHgedGPz5S+OD0XDAERWH0e6a26cWHYzGKQtPS9De6EdXyMVxmsCDxVtA7WgDSU5 t36rjImfuzybC6ydxsjrg+PbFCJEnP0mC/Ai0phzNibJtdDZZ8L3wmY/tQfuqEzc 0S1Zb/yv6CRkaoL+aG9zk3NSd9XzYWcxtRWouq4mHxsYm8lRWHgQ5PVTR1ifSLEG blLhirNaiHxW6gXgRzVxSZb0ESD8PqyPTtZrpVRgnVQsgXQxh4uM1LPHifZf3oBU iEMICHGCPOzUga3oz4ftlkaVA8SMKhezxQqoDHWVQ8ngs3SzkClJFZ5Sxfw2oBBR XfSkCFVwXCcRsoHPCgGPKuGN5I4+Zt9sM5pY/NwR0TgjUveTNX2vlqEhqKaClMex 72xyNFVrRdruE4vd/qu+DJgZsGvRv/xoUZQO3fbGXZOH2X9eKgnkNQwFPjvyc1rN p1S1EZe/RmM= =vIl4 -----END PGP SIGNATURE-----