Apache is warning developers and users about a serious vulnerability in several versions of its Struts framework that can lead to remote code execution in some circumstances.
The bug affects versions 2.0.0 through 2.5.20 and lies in the way that Struts performs the evaluation of user input in tag attributes. The problem arises when Struts is forced to do a double evaluation of Object-Graph Navigation Language (OGNL) attributes, something that an attacker can cause the framework to do with a specially crafted request. The vulnerability (CVE-2019-0230) is rated important, but the pervasiveness of the Struts framework and the potential to execute arbitrary code make it an attractive target for attackers.
“The Apache Struts frameworks, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered. With a carefully crafted request, this can lead to Remote Code Execution,” the Apache advisory says.
“If an attacker is able to modify the skillName attribute in a request such that a raw OGNL expression gets passed to the skillName property without further validation, the provided OGNL expression contained in the skillName attribute gets evaluated when the tag is rendered as a result of the request. The opportunity for using double evaluation is by design in Struts since 2.0.0 and a useful tool when done right, which most notably means only referencing validated values in the given expression. However, when referencing unvalidated user input in the expression, malicious code can get injected.”
Struts is an open-source framework widely used in enterprise environments for creating Java web apps. Apache has created a mitigation mechanism for Struts that is intended to protect apps from the kind of OGNL expression injection attack used to exploit CVE-2019-0230, but it is not enabled by default and Struts prior to 2.5.22 left open this specific attack vector.
There are several different proof-of-concept exploits available for this vulnerability, emphasizing the need for developers and organizations that deploy Struts apps to upgrade.
“However, it’s important to note that because each Struts application is unique, the actual payload needed to exploit it will differ from application to application. Additionally, the application would need to be developed in such a way that it allows an attacker to supply unvalidated input into an attribute used inside of an OGNL expression,” an analysis of the vulnerability by Tenable says.
The fix for the vulnerability is to upgrade to Struts 2.5.22.
“By upgrading to Struts 2.5.22, possible malicious effects of forced double evaluation are further limited and close the reported attack vector, especially when combined with Proactive OGNL Expression Injection Protection,” the Apache advisory says.