{"id":121007,"date":"2024-12-17T21:46:00","date_gmt":"2024-12-17T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere"},"modified":"2024-12-17T21:46:00","modified_gmt":"2024-12-17T19:46:00","slug":"uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","title":{"rendered":"Kwetsbaarheid in Apache Struts die het mogelijk maakt om code op de server uit te voeren","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In het webframework Apache Struts, dat wordt gebruikt voor het maken van webapplicaties in Java met de MVC-paradigma (Model-View-Controller), is een kwetsbaarheid ontdekt (CVE-2024-53677). Deze kwetsbaarheid stelt een externe aanvaller in staat om een bestand op een willekeurige locatie in het bestandssysteem van de server te schrijven door het indienen van een speciaal opgestelde HTTP-aanroep. Het probleem heeft betrekking op versies van 2.0.0 tot 2.3.37, van 2.5.0 tot 2.5.33 en van 6.0.0 tot 6.3.0.2, en doet zich voor in applicaties die de FileUploadInterceptor-component gebruiken voor het uploaden van bestanden naar de server. <\/p>\n

De kwetsbaarheid wordt veroorzaakt door het ontbreken van adequate validatie van de parameters die worden doorgegeven bij het uploaden van bestanden. Wanneer toegang is tot de uploadfunctionaliteit in de op Apache Struts gebaseerde webinterface, kan een aanvaller een waarde opgeven zoals «..\\\/..\\\/..\\\/..\\\/..\\\/webapps\\\/ROOT» en zo het bestand buiten de opslagdirectory voor ge\u00fcploade gegevens opslaan (prototype van de exploit). Met de mogelijkheid om bestanden naar willekeurige delen van het bestandssysteem te schrijven, kan men zijn eigen commando's uitvoeren op de server<\/a>, scripts of configuratiebestanden overschrijven, afhankelijk van de machtigingen van de gebruiker waaronder de webapplicatie draait. Als de webapplicatie draait in een Apache Tomcat-container die met root-rechten wordt uitgevoerd, kan de aanvaller geprivilegieerde toegang tot het systeem krijgen. <\/p>\n

Kwetsbaarheden in Apache Struts zijn van belang, aangezien dit framework populair is in bedrijfsystemen die via het web toegankelijk zijn. Volgens statistieken van RedMonk werd het Apache Struts-framework gebruikt in webapplicaties van 65% van de bedrijven in de Fortune 100-lijst. In 2017 leidde een aanval op het informatiesysteem van het bedrijf Equifax, dat een kwetsbare versie van Apache Struts gebruikte, tot een lek van persoonsgegevens van 143 miljoen inwoners van de VS.
\n
Bron: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441 2.0.0 \u043f\u043e 2.3.37, c 2.5.0 \u043f\u043e 2.5.33 \u0438 \u0441 6.0.0 \u043f\u043e 6.3.0.2, \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121007","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheid in Apache Struts, waardoor code op de server kan worden uitgevoerd | ProHoster","description":"In het webframework Apache Struts, dat wordt gebruikt voor het maken van webapplicaties in Java met de MVC-paradigma (Model-View-Controller), is een kwetsbaarheid ontdekt (CVE-2024-53677).","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Struts, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 web-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Apache Struts, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Java \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u0440\u0430\u0434\u0438\u0433\u043c\u044b \u041cV\u0421 (Model-View-Controller), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-53677).","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-apache-struts-pozvolyayushhaya-vypolnit-kod-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-12-17T19:46:00+00:00","article:modified_time":"2024-12-17T19:46:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121007","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:04:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:57:19","updated":"2026-02-09 22:04:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/121007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=121007"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/121007\/revisions"}],"predecessor-version":[{"id":160072,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/121007\/revisions\/160072"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=121007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=121007"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=121007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}