Security bypass in Apache Struts - CVE-2014-0094
Published: January 23, 2017 / Updated: October 22, 2022
Vulnerability identifier: #VU5234
CSH Severity: Critical
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0094
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restsrictions on the target system.
The weakness exists due to an error in ParametersInterceptor. A remote attacker can use a specially crafted class parameter to manipulate the ClassLoader used by the application server.
Successful exploitation of the vulnerability results in security bypass on the vulnerable system.
Note: the vulnerability was being actively exploited.
The weakness exists due to an error in ParametersInterceptor. A remote attacker can use a specially crafted class parameter to manipulate the ClassLoader used by the application server.
Successful exploitation of the vulnerability results in security bypass on the vulnerable system.
Note: the vulnerability was being actively exploited.
Affected software
Apache Struts
FlashSystem V840 9846-AE1 & 9848-AE1
IBM Sterling Order Management
Call Center for Commerce
IBM Storwize V7000
IBM Storwize V5000
IBM Storwize V3700
IBM Storwize V3500
FlashSystem V840 9846-AE1 & 9848-AE1
IBM Sterling Order Management
Call Center for Commerce
IBM Storwize V7000
IBM Storwize V5000
IBM Storwize V3700
IBM Storwize V3500
How to mitigate CVE-2014-0094
Update to version 2.3.16.2.
Apache Struts - update to 2.3.16.2
IBM Storwize V7000 - update to 7.2.0.9
IBM Storwize V5000 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3700 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3500 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Sterling Order Management - update to 10.0.0.29
Call Center for Commerce - update to 10.0.12
IBM Storwize V7000 - update to 7.2.0.9
IBM Storwize V5000 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3700 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Storwize V3500 - addressed in versions 7.2.0.9, 7.3.0.7, 7.4.0.0
IBM Sterling Order Management - update to 10.0.0.29
Call Center for Commerce - update to 10.0.12
Links to Public Exploits and PoC-codes
- Exploit #8515 - strutt-cve-2014-0114 () (October 22, 2022)
- Exploit #849 - Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit) (March 18, 2020)
- Exploit #850 - Apache Struts - ClassLoader Manipulation Remote Code Execution (Metasploit) (March 18, 2020)
- Exploit #1755 - Apache Struts ClassLoader Manipulation Remote Code Execution (March 18, 2020)