Apache Releases Security Updates

Scheduled updates for Apache Struts 2

Threat ID:: CC-4075
Threat Severity:: Medium
Published:: 14 April 2022 11:33 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Apache Struts 2

Affected platforms

The following platforms are known to be affected:

Versions: 2.0.0 to 2.5.29

Apache Struts 2

Threat details

Introduction

The Apache Software Foundation has released a security update to address a vulnerability known as CVE-2021-31805 in Apache Struts 2.

In December 2020, the Apache Software Foundation released fix S2-061, which was meant to fully remediate vulnerability CVE-2020-17530. The fix was not complete, however, and so the remaining vulnerability is CVE-2021-31805. Both vulnerabilities concern forced Object-Graph Navigation Language (OGNL) evaluation under certain conditions leading to possible remote code execution.

A remote attacker could exploit this vulnerability to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review Apache Security Bulletin S2-062 and apply the necessary update or workaround.

Definitive source of threat updates

https://www.cisa.gov/uscert/ncas/current-activity/2022/04/12/apache-releases-security-advisory-struts-2

CVE Vulnerabilities

Status Published

CVE-2020-17530

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

Status Published

CVE-2021-31805

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Last edited: 14 April 2022 12:36 pm