Vulnerability · Published Dec 7, 2023 · Assigned by apache
CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability
Critical 9.8
In plain English
A critical-severity security flaw in Apache Struts from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 80.8% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.5.33 | GHSA-2j39-qcjm-428w |
| Maven | org.apache.struts:struts2-core | 6.3.0.2 | GHSA-2j39-qcjm-428w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 – through 2.5.326.0.0 – through 6.3.0.1 |
Weakness: CWE-552
References
- https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj vendor-advisory, mailing-list
- https://www.openwall.com/lists/oss-security/2023/12/07/1
- http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html
- https://security.netapp.com/advisory/ntap-20231214-0010/