Mailing List Archive: [ANN] Struts 2.3.16.1 GA release available

[ANN] Struts 2.3.16.1 GA release available - security fix

Mar 6, 2014, 1:04 AM

Post #1 of 4 (1658 views)

The Apache Struts group is pleased to announce that Struts 2.3.16.1 is
available as a "General Availability" release.The GA designation is
our highest quality grade.

Apache Struts 2 is an elegant, extensible framework for creating
enterprise-ready Java web applications. The framework is designed to
streamline the full development cycle, from building, to deploying, to
maintaining applications over time.

This release includes important security fixes:
- S2-020 - ClassLoader manipulation via request parameters
- upgraded Commons FileUpload library to prevent DoS attacks

* http://struts.apache.org/release/2.3.x/docs/s2-020.html

All developers are strongly advised to update existing Struts 2
applications to Struts 2.3.16.1

Struts 2.3.16.1 is available in a full distribution, or as separate
library, source, example and documentation distributions, from the
releases page.
* http://struts.apache.org/download.cgi#struts23161

The release is also available from the central Maven repository under
Group ID "org.apache.struts".

The 2.3.x series of the Apache Struts framework has a minimum
requirement of the following specification versions:
* Java Servlet 2.4 and JavaServer Pages (JSP) 2.0
* Java 2 Standard Platform Edition (J2SE) 5

The release notes are available online at:
* http://struts.apache.org/release/2.3.x/docs/version-notes-23161.html

Should any issues arise with your use of any version of the Struts
framework, please post your comments to the user list, and, if
appropriate, file a tracking ticket.appropriate, file a tracking
ticket:
* https://issues.apache.org/jira/browse/WW

- The Apache Struts group.

Regards
--
Åukasz
+ 48 606 323 122 http://www.lenart.org.pl/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [ANN] Struts 2.3.16.1 GA release available - security fix [ In reply to ]

tim-security at sentinelchicken

Mar 6, 2014, 7:43 AM

Post #2 of 4 (1635 views)

Permalink

> This release includes important security fixes:
> - S2-020 - ClassLoader manipulation via request parameters

What is the ultimate impact of this manipulation? Another RCE bug?

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [ANN] Struts 2.3.16.1 GA release available - security fix [ In reply to ]

lukaszlenart at apache

Mar 6, 2014, 9:07 AM

Post #3 of 4 (1616 views)

Permalink

No, rather no. You gain access to ClassLoader.

2014-03-06 16:43 GMT+01:00 Tim <tim-security@sentinelchicken.org>:
>
>> This release includes important security fixes:
>> - S2-020 - ClassLoader manipulation via request parameters
>
> What is the ultimate impact of this manipulation? Another RCE bug?
>
> tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [ANN] Struts 2.3.16.1 GA release available - security fix [ In reply to ]

tim-security at sentinelchicken

Mar 6, 2014, 11:03 AM

Post #4 of 4 (1626 views)

Permalink

> No, rather no. You gain access to ClassLoader.

Ok... Many past bugs in different contexts have involved ClassLoader
and have lead to *very bad things*. I want to be sure you aren't
playing coy about how serious the issue is. But as I brush up on how
struts/OGNL works, I can see how an attacker might be somewhat limited
here.

However, unless I'm missing something, it seems like your recommended
regex may not be adequate to prevent ClassLoader access. I'm
referring to this suggested mitigation:

"
Simple add '^class\.*' to the list of excludeParams as below

<interceptor-ref name="params">
<param
name="excludeParams">^class\..*,^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>
</interceptor-ref>

"

This blocks parameters that start with "class", but what about ones
that contain class internally? Based on [1], I would think an
attacker could send a parameter like this:

anObject.class.classLoader...

Which would result in, effectively:

action.getAnObject.getClass.getClassLoader...

So long as a developer defines an action within their application that
that has *any* get method that returns an Object ("getAnObject" in
this example), then they'd still be able to get at the ClassLoader
with your exclusion regex, right? Or am I missing something about
other mitigations you guys have put into place in prior versions?

Thanks,
tim

1. http://blog.o0o.nu/2010/07/cve-2010-1870-struts2xwork-remote.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/