In the Apache Struts web framework, used for creating web applications in Java with the MVC (Model-View-Controller) paradigm, a vulnerability (CVE-2024-53677) has been discovered. This vulnerability allows an external attacker to write a file to any location in the server's file system by sending a specially crafted HTTP request. The issue affects versions from 2.0.0 to 2.3.37, from 2.5.0 to 2.5.33, and from 6.0.0 to 6.3.0.2, and manifests in applications using the FileUploadInterceptor component for file uploads on the server.
The vulnerability is caused by insufficient validation of parameters passed during file uploads. If an attacker has access to the file upload functions in the Apache Struts-based web interface, they can specify a value like "..\/..\/..\/..\/..\/webapps\/ROOT" and succeed in saving a file outside the directory designated for uploaded data (prototype of the exploit). Gaining the ability to write files to arbitrary parts of the file system can enable command execution on the server. serwerze, overwriting scripts or configuration files, depending on the permissions of the user under which the web application runs. If the web application runs in an Apache Tomcat container with root privileges, the attacker may gain privileged access to the system.
Vulnerabilities in Apache Struts are significant as this framework is widely used in corporate systems accessible via the web. According to RedMonk statistics, the Apache Struts framework was used in web applications by 65% of companies in the Fortune 100 list. In 2017, an attack on Equifax's information system, which used a vulnerable version of Apache Struts, led to a leak of personal data of 143 million residents of the USA.
Źródło: opennet.ru
