Back to list
[ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact
May 01 2014 06:59PM
Rene Gielen (rgielen apache org)
Re: [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact
May 01 2014 07:10PM
Eric Reed (EREED2 MAIL NYSED GOV)
Thank you for your insight and advice.
I have successfully secured 5 production applications with proof of
concept before and after and have re-deployed these critical
applications in under 4 hours with very little down time.
>>> Rene Gielen <rgielen (at) apache (dot) org [email concealed]> 5/1/2014 2:59 PM >>>
As confirmed in our last announcement, the Apache Struts 1 framework
all versions is affected by a ClassLoader manipulation vulnerability
(CVE-2014-0114) similar to a recently fixed vulnerability in Struts 2
(CVE-2014-0112, CVE-2014-0094) .
Thanks to the efforts of Alvaro Munoz and the HP Fortify team, the
Apache Struts project team can recommend a first mitigation that is
relatively simple to apply. It involves the introduction of a generic
Servlet filter, adding the possibility to blacklist unacceptable
parameters based on regular expressions. Please see the corresponding
Fortify blog entry  for detailed instructions.
The HP Fortify team also informed us that the vulnerability may be
exploited for Remote Code Execution (RCE) in certain environments.
on this information, the Apache Struts project team recommends to
the mitigation advice *immediately* for all Struts 1 based
Struts 1 has had its End-Of-Life announcement more than one year ago
. However, in a cross project effort the Struts team is looking for
correction or an improved mitigation path. Please stay tuned for
information regarding a solution.
This is a cross-list posting. If you have questions regarding this
report, please direct them to security (at) struts.apache (dot) org [email concealed] only.
To unsubscribe, e-mail: user-unsubscribe (at) struts.apache (dot) org [email concealed]
For additional commands, e-mail: user-help (at) struts.apache (dot) org [email concealed]
[ reply ]
Copyright 2010, SecurityFocus