Struts S2-059, S2-060 Vulnerabilities (CVE-2019-0230, CVE-2019-0233) Threat Alert

Struts S2-059, S2-060 Vulnerabilities (CVE-2019-0230, CVE-2019-0233) Threat Alert

September 11, 2020 | Adeline Zhang

Overview

On August 13, 2020, Beijing time, Struts issued a new security bulletin to announce the fix of two vulnerabilities. S2-059 (CVE-2019-0230) is a possible remote code execution vulnerability, and S2-060 (CVE-2019-0233) is a denial-of-service vulnerability.

The two vulnerabilities were fixed in Struts 2.5.22 released in November 2019. Users are advised to upgrade as soon as possible.

Bulletin link: https://struts.apache.org/announce.html#a20200813

Vulnerability Description

  • S2-059

The vulnerability (CVE-2019-0230) results from double evaluation of values assigned to tag attributes when the Apache Struts framework is forced, which may lead to remote code execution. Only when the OGNL expression is forced in a Struts tag attribute can the vulnerability be triggered.

For more information, please visit: https://cwiki.apache.org/confluence/display/ww/s2-059

  • S2-060

The vulnerability (CVE-2019-0233) stems from the fact that an attacker may cause an access permission error via a special request when performing a file upload. As a result, the upload will fail, causing a denial-of-service attack.

For more information, please visit: https://cwiki.apache.org/confluence/display/ww/s2-059

Affected Versions

  • Struts 2.0.0 – Struts 2.5.20

Unaffected Versions

Solution

Struts has released new versions to fix the preceding vulnerabilities. Affected users are advised to upgrade as soon as possible.

Users who cannot upgrade to the latest version for the time being can refer to the workarounds provided by Struts:

  • S2-059
  • Add a proper validation of incoming parameters’ values when re-assigning them to certain Struts’ tags attributes.
  • Consider activating Proactive OGNL Expression Injection Protection.

Reference link: https://cwiki.apache.org/confluence/display/ww/s2-059

  • S2-060

Find the struts.excludedPackageNames constant in the struts-default.xml file, and add jave.io. and java.nio. to the constant’s attribute.

Reference link: https://cwiki.apache.org/confluence/display/WW/S2-060

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA). A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.