Recently Struts patched a vulnerability allowing attackers to execute remote code. Apparently not patching this is like giving black-hats a red carpet welcome with a bandwagon.
http://struts.apache.org/release/2.3.x/docs/s2-016.html
Basically it allows attack command execution like this :
Legit action :
http://host/struts2-showcase/employee/save.action?redirect:%25{3*4}
Exploited action :
http://host/struts2-showcase/employee/save.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
While I know that upgrading should be done ASAP, the as soon as possible will mean some time since our code base uses old struts versions and plugins.
Which will require some refactoring to upgrade the Struts 2 libraries, then those need to be tested etc.
My question therefore is whether anyone has any idea to stop this vulnerability from being executed? This will be only till we are able to upgrade.
I was wondering whether writing an interceptor to sanitize the URL before being evaluated against the OGNL is possible and if so will it mitigate this issue?
Other idea I had was to use the Java security manager somehow to stop arbitrary process invocations, is this possible? Will it patch the hole temporary?
The server being used is jBoss if anyone think that's relevant.
The problem is related to DefaultActionMapper and how it handles special parameters. This class could be extended to override handleSpecialParameters method. However, if you turn off DMI these special parameters no longer work. Use the constant configuration
<constant name="struts.enable.DynamicMethodInvocation" value="false"/>