bugtraq - [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <53629980.8060805@apache.org>
Date: Thu, 01 May 2014 20:59:12 +0200
From: Rene Gielen <rgielen@...che.org>
To: announce@...che.org, announcements@...uts.apache.org,
  Struts Users Mailing List <user@...uts.apache.org>,
  Struts Developers List <dev@...uts.apache.org>,
  full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
CC: "security@...uts.apache.org" <security@...uts.apache.org>
Subject: [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available,
 Possible RCE Impact

As confirmed in our last announcement, the Apache Struts 1 framework in
all versions is affected by a ClassLoader manipulation vulnerability
(CVE-2014-0114) similar to a recently fixed vulnerability in Struts 2
(CVE-2014-0112, CVE-2014-0094) [1].

Thanks to the efforts of Alvaro Munoz and the HP Fortify team, the
Apache Struts project team can recommend a first mitigation that is
relatively simple to apply. It involves the introduction of a generic
Servlet filter, adding the possibility to blacklist unacceptable request
parameters based on regular expressions. Please see the corresponding HP
Fortify blog entry [2] for detailed instructions.

The HP Fortify team also informed us that the vulnerability may be
exploited for Remote Code Execution (RCE) in certain environments. Based
on this information, the Apache Struts project team recommends to apply
the mitigation advice *immediately* for all Struts 1 based applications.

Struts 1 has had its End-Of-Life announcement more than one year ago
[3]. However, in a cross project effort the Struts team is looking for a
correction or an improved mitigation path. Please stay tuned for further
information regarding a solution.

This is a cross-list posting. If you have questions regarding this
report, please direct them to security@...uts.apache.org only.

[1] http://struts.apache.org/release/2.3.x/docs/s2-021.html
[2]
http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Protect-your-Struts1-applications/ba-p/6463188#.U2J7xeaSxro
[3] http://struts.apache.org/struts1eol-announcement.html

-- 
René Gielen
http://twitter.com/rgielen