Advisory details:
github_osv / GHSA-p66x-2cv9-qq3v
| Advisory ID | github_osv/GHSA-p66x-2cv9-qq3v |
| Aliases |
CVE-2014-0114
|
| Summary | Arbitrary code execution in Apache Commons BeanUtils Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-20 | Improper Input Validation |
| System | Score | Found at |
|---|---|---|
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a remote command execution vulnerability in Apache Struts versions 1.x (<= 1.3.10) and 2.x (< 2.3.16.2). In Struts 1.x the problem is related with the ActionForm bean population mechanism while in case of Struts 2.x the vulnerability is due to the ParametersInterceptor. Both allow access to 'class' parameter that is directly mapped to getClass() method and allows ClassLoader manipulation. As a result, this can allow remote attackers to execute arbitrary Java code via crafted parameters. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | March 6, 2014 |
| Platform | Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/struts_code_exec_classloader.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | March 23, 2017 |
| Description | Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | March 6, 2014 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | March 23, 2017 |
| Source URL | https://github.com/rapid7/metasploit-framework/blob/3123175ac75c38bec5165e01cda05e3b38287003/modules/exploits/multi/http/struts_code_exec_classloader.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.