CVE-2018-11776

Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16: Remote Code Execution via alwaysSelectFullNamespace

• CVSS 8.1
• CWE-20 Improper Input Validation
• Input Validation and Sanitization
• Remote

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

CVE

CVE-2018-11776

CWE

CWE-20 Improper Input Validation

CVSS base score

8.1

Published

2018-08-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Apache Struts to version 2.5.17 or higher.

from flask import Flask, request

app = Flask(__name__)

@app.route('/execute', methods=['POST'])
def execute_action():
    """Vulnerable function that demonstrates the security issue."""
    action = request.form.get('action')

    if action:
        exec(action)

    return "Action executed"

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort

app = Flask(__name__)

BLACKLIST = {'import', 'exec', 'eval', 'open', '__', 'os', 'system', 'subprocess'}

def check_action(action):
    """Secure function that fixes the vulnerability."""
    if not action:
        return False
    lowered = action.lower()
    for bad_word in BLACKLIST:
        if bad_word in lowered:
            return False
    return True

@app.route('/execute', methods=['POST'])
def execute_action():
    """Secure function that fixes the vulnerability."""
    action = request.form.get('action')

    if not check_action(action):
        abort(400, "Unsafe action")

    try:
        exec(action)
    except Exception as e:
        abort(500, f"Execution error: {e}")
    
    return "Action executed"

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve201811776,
  title        = {{Apache Struts 2.3 to 2.3.34 and 2.5 to 2.5.16: Remote Code Execution via alwaysSelectFullNamespace}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2018-11776},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2018-11776/}}
}