An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
The attacker manipulates HTTP request parameters responsible for file upload to bypass target path restrictions (path traversal, CWE-552 — improper access control to resources on the server side). As a result, it is possible to save a file in an unexpected location on the server. If the file is placed in a directory accessible by the application server, it can be subsequently executed as server code, leading to full RCE.
An unauthenticated attacker can gain full control over the application server — read confidential data, modify it, and execute arbitrary system commands (RCE).
Apache Struts must be updated to version 2.5.33 or 6.3.0.2 or newer. The vendor clearly indicates these versions as containing the security patch.
Apache Struts in versions prior to 2.5.33 and prior to 6.3.0.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Struts
APPApache2.0.0 – 2.5.33 (bez)6.0.0 – 6.3.0.2 (bez)
Related vulnerabilities
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution....
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field v...
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect ex...
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a paramet...
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressio...