A vulnerability has been identified in the Apache Struts web framework, used for creating web applications in Java with the MVC (Model-View-Controller) paradigm (CVE-2024-53677). This vulnerability allows an external attacker to write a file to an arbitrary location in the server's file system through specially crafted HTTP requests. The issue affects releases from 2.0.0 to 2.3.37, from 2.5.0 to 2.5.33, and from 6.0.0 to 6.3.0.2, and manifests in applications that use the FileUploadInterceptor component for file uploads.
The vulnerability is caused by the lack of proper validation of the parameters passed during file uploads. If an attacker has access to file upload features in an Apache Struts-based web interface, they can specify a value like "..\/..\/..\/..\/..\/webapps\/ROOT" to achieve file storage outside the directory designated for uploaded data (exploit prototype). Gaining the capability to write files to arbitrary portions of the file system allows for the execution of commands on server, overwriting scripts or configuration files, depending on the permissions of the user under which the web application runs. If the web application is executed in an Apache Tomcat container running with root privileges, the attacker may gain privileged access to the system.
Vulnerabilities in Apache Struts are significant because this framework is widely used in corporate systems accessible via the web. According to RedMonk statistics, the Apache Struts framework was utilized in web applications by 65% of companies in the Fortune 100 list. In 2017, an attack on the information system of Equifax, which used a vulnerable version of Apache Struts, resulted in the leak of personal data of 143 million residents of the U.S.
Source: opennet.ru
