Signature Detail
Short Name |
HTTP:APACHE:STRUTS-INCLUDPARAMS |
|---|---|
Severity |
High |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Apache Struts includeParams Remote Code Execution |
Release Date |
2013/06/05 |
Update Number |
2270 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Apache Struts includeParams Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Apache Struts. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the affected application.
Extended Description
Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Affected Products
- apache struts 2.0.0
- apache struts 2.0.1
- apache struts 2.0.10
- apache struts 2.0.11
- apache struts 2.0.11.1
- apache struts 2.0.11.2
- apache struts 2.0.12
- apache struts 2.0.13
- apache struts 2.0.14
- apache struts 2.0.2
- apache struts 2.0.3
- apache struts 2.0.4
- apache struts 2.0.5
- apache struts 2.0.6
- apache struts 2.0.7
- apache struts 2.0.8
- apache struts 2.0.9
- apache struts 2.1.0
- apache struts 2.1.1
- apache struts 2.1.2
- apache struts 2.1.3
- apache struts 2.1.4
- apache struts 2.1.5
- apache struts 2.1.6
- apache struts 2.1.8
- apache struts 2.1.8.1
- apache struts 2.2.1
- apache struts 2.2.1.1
- apache struts 2.2.3
- apache struts 2.2.3.1
- apache struts 2.3.1
- apache struts 2.3.1.1
- apache struts 2.3.12
- apache struts 2.3.1.2
- apache struts 2.3.3
- apache struts 2.3.4
- apache struts 2.3.4.1
- apache struts 2.3.7
- apache struts 2.3.8
- apache struts up to 2.3.14
References
- BugTraq: 60166
- BugTraq: 60167
- CVE: CVE-2013-1966
- CVE: CVE-2013-2115