Industry Observations-Technical Insight-Vulnerabilities

Apache Struts ClassLoader Vulnerability

A patch issued in March for a previously known vulnerability in Apache Struts Version 2.0.0 – 2.3.16 has been bypassed. The vulnerability allowed attackers to manipulate the ClassLoader leading to possible remote code execution and denial of service. Struts versions 2.0.0-2.3.16.1 are all currently vulnerable to attack. As of today no patch is available however Apache has a detailed write up on how to mitigate the vulnerability while they work on a security patch. Details can be found at http://struts.apache.org/announce.html#a20140424

WhiteHat has added detection for the Struts ClassLoader vulnerability across all service lines. Both dynamic and static assessments have been updated and will begin testing as soon as the next scan begins.

Our Customer Success team would be happy to answer any questions you may have regarding this issue. They can be reached by emailing support@whitehatsec.com

Editor’s Note: A patch has been released by Apache on Saturday 4/26 which should fix the ClassLoader issue in Struts. Users are encouraged to update to Struts 2.3.16.2 immediately. Details can be found at http://struts.apache.org/announce.html#a20140424