ITS ADVISORY NUMBER:
Vulnerabilities in Apache Struts Could Allow Remote Code Execution
Vulnerabilities have been discovered in Apache Struts which could allow remote code execution. Apache Struts is an open source, model-view-controller (MVC) framework used for building Java web applications. Successful exploitation could result in an attacker executing arbitrary code in the context of affected application. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Versions 2.0.0 - 18.104.22.168
- Large and medium government entities: High
- Small government entities: High
- Large and medium business entities: High
- Small business entities: High
Home users: N/A
Vulnerabilities have been found in Apache Struts versions 2.0.0 - 22.214.171.124 which could allow for remote code execution. The details of these vulnerabilities are as follows:
- S2-018 - A broken access control vulnerability exists in the action mapping mechanism which is intended to help with attaching navigational information to buttons within forms.
- S2-019 - A vulnerability exists because Dynamic Method Invocation within the Struts framework is enabled by default. Apache disclosed that the Dynamic Method Invocation, which handles the activation of a process (method) within an object at runtime, is known to support multiple security risks.
Successful exploitation could result in an attacker executing arbitrary code in the context of affected application. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
We recommend the following actions be taken:
- Upgrade vulnerable Apache Struts products immediately after appropriate testing.
- Disable the Dynamic Method Invocation. In version 126.96.36.199, Dynamic Method Invocation is set to false by default.
- Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
- Apply the principle of Least Privilege to all services.
Acting Chief Information Security Officer
- EISO Home
- Incident Reporting
- Breach Notification
- Cyber Advisories
- NYS Digital Forensics
- Cyber Tips Newsletter
- Keeping Kids Safe Online
- Local Government
- Policies and Resources
- NY-ISAC Secure Portal
- Contact EISO