Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (nike.apache.org: domain of d.subbanarasimha@kewill.com
 designates 213.199.154.13 as permitted sender)
From: Deepak Subbanarasimha <d.subbanarasimha@kewill.com>
To: "user@struts.apache.org" <user@struts.apache.org>
Subject: Struts zero-day vulnerability
Thread-Topic: Struts zero-day vulnerability
Thread-Index: 
 Ac9j2xz1ria+Iwn/SmKbYYFsam8YLAAAcvRgAADJ9/AABxAcEACBjaMQAAc6P6AAjklKsA==
Date: Mon, 5 May 2014 11:53:55 +0000
Message-ID: 
 <28d83d343a37450cb76fbea612eeb495@DB3PR04MB172.eurprd04.prod.outlook.com>
References: 
 <7DF757161F85734FBF5CEE6BCEC1614F9864ED645B@CPGEXMBCCR03.cpggpc.ad>
 <d0eefe243f6c45a9a7ef04e7aad0ae21@AMSPR04MB082.eurprd04.prod.outlook.com>
 <CACD1C05C542904F921C6164EA80E2FD3D6917F4AF@CPGEXMBCCR03.cpggpc.ad>
 <081ab247b18f4989ae40ae9ba9502285@DB3PR04MB172.eurprd04.prod.outlook.com>
 <CACD1C05C542904F921C6164EA80E2FD3D6929A690@CPGEXMBCCR03.cpggpc.ad>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (: kewill.com does not designate permitted sender hosts)
Content-Type: multipart/alternative;
	boundary="_000_28d83d343a37450cb76fbea612eeb495DB3PR04MB172eurprd04pro_"
MIME-Version: 1.0

--_000_28d83d343a37450cb76fbea612eeb495DB3PR04MB172eurprd04pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello,

We use struts version 1.2.2 and commons-file upload version 1.1.1.  It is n=
ot clear from this notification if these versions are impacted.


1.       Can anyone confirm if these versions or affected?

2.       If they are affected, what can be done? Should we upgrade to Strut=
s 2.x?

The notification below only talks about struts 2.x version.

-Deepak


PURPOSE

-------------

The purpose of this Alert is to bring attention to a recently announced sec=
urity vulnerability for Apache Struts.


ASSESSMENT

------------------

Apache Struts up to 2.3.16.1 is being reported as having a zero-day vulnera=
bility. In particular, Struts 2.3.16.1 has an issue with ClassLoader manipu=
lation via request parameters which was supposed to be resolved on 2 March =
2014 through a security fix. Unfortunately, it was confirmed that the corre=
ction wasn't sufficient.


According to the Apache Struts Team, a security fix release fully addressin=
g all these issues is in preparation and will be released as soon as possib=
le. Once the release is available, all Struts 2 users are strongly encourag=
ed to update their installations.


SUGGESTED ACTION

----------------------------

The Apache Struts Team has published the following mitigation information:


In the struts.xml, replace all custom references to params-interceptor with=
 the following code, especially regarding the class-pattern found at the be=
ginning of the excludeParams list:


<interceptor-ref name=3D"params">

   <param

name=3D"excludeParams">(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*,^dojo\.=
.*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|=
Response)\..*,^parameters\..*,^action:.*,^method:.*</param>

</interceptor-ref>


If you are using default interceptor stacks packaged in struts-default.xml,=
 change your parent packages to a customized secured configuration as in th=
e following example. Given you are using defaultStack so far, change your p=
ackages from


<package name=3D"default" namespace=3D"/" extends=3D"struts-default">

    <default-interceptor-ref name=3D"defaultStack" />

    ...

    ...

</package>

to


<package name=3D"default" namespace=3D"/" extends=3D"struts-default">

    <interceptors>

        <interceptor-stack name=3D"secureDefaultStack">

            <interceptor-ref name=3D"defaultStack">

                <param

name=3D"params.excludeParams">(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*,=
^dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(R=
equest|Response)\..*,^parameters\..*,^action:.*,^method:.*</param>

            </interceptor-ref>

        </interceptor-stack>

    </interceptors>


    <default-interceptor-ref name=3D"secureDefaultStack" />

    ...

</package>


References:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

http://struts.apache.org/announce.html#a20140302

IMPORTANT NOTICE: This email is intended solely for the use of the individu=
al to whom it is addressed and may contain information that is privileged, =
confidential or otherwise exempt from disclosure under applicable law. If t=
he reader of this email is not the intended recipient or the employee or ag=
ent responsible for delivering the message to the intended recipient, you a=
re hereby notified that any dissemination, distribution, or copying of this=
 communication is strictly prohibited. If you have received this communicat=
ion in error, please immediately return the original message to the sender =
at the listed email address. In accordance with Kewill policy, emails sent =
and received may be monitored. Although Kewill takes reasonable precautions=
 to minimize the risk, Kewill accepts no responsibility for any loss or dam=
age should this email contain any virus, or similar destructive or mischiev=
ous code.

--_000_28d83d343a37450cb76fbea612eeb495DB3PR04MB172eurprd04pro_--