Struts2 Vulnerability Alert

Struts2 devMode Causes Remote Code Execution Vulnerability

What is devMode?

The so-called devMode, as the name suggests, is prepared for Struts2 developers to debug programs. In this mode, logs and other information can be conveniently viewed. By default, devMode is disabled. However, in practice, many websites still blatantly use devMode when they go live, naturally facing greater security issues and needing to be fixed as soon as possible.

Affected Scope:

When Struts enables devMode, this vulnerability affects Struts 2.1.0–2.5.1, and can affect all Struts2 versions.

Remediation:

Disable devMode: set in struts.xml

<constant name="struts.devMode" value="false" />

Struts2-related vulnerability notes:

===========================================================================================

[+]11 S2-046  CVE-2017-5638   Can execute CMD commands

[+]10 S2-045  CVE-2017-5638   Can execute CMD commands

[+]9 devMode CVE-xxxx-xxxx   Can GetShell / obtain physical path / execute CMD commands

[+]8 S2-037  CVE-2016-4438   Can GetShell / obtain physical path / execute CMD commands

[+]7 S2-032  CVE-2016-3081   Can GetShell / obtain physical path / execute CMD commands

[+]6 S2-020  CVE-2014-0094   Can GetShell

[+]5 S2-019  CVE-2013-4316   Can GetShell / obtain physical path / execute CMD commands

[+]4 S2-016  CVE-2013-2251   Can GetShell / obtain physical path / execute CMD commands

[+]3 S2-013  CVE-2013-1966   Can GetShell / obtain physical path / execute CMD commands

[+]2 S2-009  CVE-2011-3923   Can GetShell / obtain physical path / execute CMD commands

[+]1 S2-005  CVE-2010-1870   Can GetShell / obtain physical path / execute CMD commands / list file directories

===========================================================================================

Solution:

Update the Struts2 jar package to the latest version. Please upgrade according to the version you are using

http://mirrors.hust.edu.cn/apache/struts/
 

Another most important point: if you are deploying the Java environment yourself, be sure not to use the root or administrator account to run Java applications!!