Code Injection in Apache Struts - CVE-2019-0230

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The Apache Struts frameworks, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered. With a carefully crafted request, this can lead to Remote Code Execution (RCE).

The problem only applies when forcing OGNL evaluation inside a Struts tag attribute, when the expression to evaluate references raw, unvalidated input that an attacker is able to directly modify by crafting a corresponding request.

Example:

<s:url var="url" namespace="/employee" action="list"/><s:a id="%{skillName}" href="%{url}">List available Employees</s:a>

If an attacker is able to modify the skillName attribute in a request such that a raw OGNL expression gets passed to the skillName property without further validation, the provided OGNL expression contained in the skillName attribute gets evaluated when the tag is rendered as a result of the request.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2019-0230

Links to Public Exploits and PoC-codes

• Exploit #5647 - Apache Struts 2.5.20 - Double OGNL evaluation (June 17, 2021)
• Exploit #4961 - Apache Struts 2 Forced Multi OGNL Evaluation (December 23, 2020)
• Exploit #4512 - CVE-2019-0230 (CVE-2019-0230 Exploit POC) (August 21, 2020)

External References

• https://cwiki.apache.org/confluence/display/WW/S2-059

Related Security Bulletins

• Multiple vulnerabilities in Apache Struts
• Multiple vulnerabilities in Oracle Financial Services Market Risk Measurement and Management
• Code Injection in Oracle Financial Services Data Integration Hub
• Multiple vulnerabilities in IBM Sterling File Gateway
• Multiple vulnerabilities in IBM eDiscovery Manager
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Call Center for Commerce