05 June 2013, 14:48

Apache Struts gets another important security fix

Apache Struts Just a week ago, the Apache Struts developers released an important security fix which has now been followed by another important fix for a highly critical security flaw in the web framework. The vulnerability being closed is a combination of two problems. The framework allows action mapping based on wildcards and when a request doesn't match an action, it tries to load a JSP file based on the name of the action. That name can be treated as an OGNL expression and in turn, that allows an attacker to execute Java code on the server side.

Details of the problem together with examples are available in the S2-015 security advisory. Users of the framework are recommended to upgrade to version 2.3.14.3 which is already available to download. The update checks that action names match a regular expression of [a-z]*[A-Z]*[0-9]*[.\-_!/]* (though admins can change the regexp of allowed names through a constant in struts.xml) and the developers have removed the double evaluation from the OgnlTextParser. The bug, like the previous one, was discovered by Coverity which has published a detailed blog posting on the problem.

(djwm)

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-1883156