Apache Struts Remote Code Execution Vulnerability (CVE-2018-11776)

On This Page

Security Alerts

July 9, 2019

Zoom Client through 4.4.4 on macOS Remote Vulnerability (CVE-2019-13450)

June 18, 2019

CVE-2019-11477 - Linux and FreeBSD Kernel: Multiple TCP-based remote denial of service vulnerabilities

May 14, 2019

Patch IMMEDIATELY! - Microsoft Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708)
MS Windows Error Reporting Local Privilege Escalation Vulnerability (CVE-2019-0863)

March 14, 2019

Critical File Content Disclosure & DoS Vulnerabilities in Ruby on Rails (CVE-2019-5418)
News Archive
August 23, 2018
Josh Kwan

Summary

A critical remote code execution vulnerability has been discovered in Apache Struts, a popular open source framework for developing web applications in the Java programming language. [1] In the past, Apache Struts RCE vulnerabilities have been weaponized in less than 24 hours -- one of which resulted in the Equifax breach that totaled over $600 million in cost. [2]

It is recommended that you upgrade immediately if you are using Apache Struts, or contact your vendor if you manage vendor applications that rely on Apache Struts.

Impact

Attackers may be able to remotely execute arbitrary code against vulnerable Apache Struts installations. [1]

Vulnerable

  • Apache Struts 2.3 through 2.3.34
  • Apache Struts 2.5 through 2.5.16
  • Unsupported (end-of-life) versions of Apache Struts may also be vulnerable [1]

Recommendations

  • Upgrade immediately to Apache Struts 2.3.35 or 2.5.17
  • Contact your vendor for security patches if you manage vendor applications that utilize Apache Struts

References

[1] https://cwiki.apache.org/confluence/display/WW/S2-057

[2] https://semmle.com/news/apache-struts-CVE-2018-11776

[3] https://nvd.nist.gov/vuln/detail/CVE-2018-11776