CVE-2018-11776

critical-risk
Published 2018-08-22

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Do I need to act?

!
94.4% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
3 public exploits available
45260, 45367, 45262
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (10)

Affected Vendors

Apache Oracle Netapp

References (39)

Third Party Advisory http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution....
Broken Link http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
Patch http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787...
Patch http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Broken Link http://www.securityfocus.com/bid/105125
Broken Link http://www.securitytracker.com/id/1041547
Broken Link http://www.securitytracker.com/id/1041888
Issue Tracking https://cwiki.apache.org/confluence/display/WW/S2-057
Exploit https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
Exploit https://lgtm.com/blog/apache_struts_CVE-2018-11776
Mailing List https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0...
Third Party Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012
Third Party Advisory https://security.netapp.com/advisory/ntap-20180822-0001/
Third Party Advisory https://security.netapp.com/advisory/ntap-20181018-0002/
Exploit https://www.exploit-db.com/exploits/45260/
Exploit https://www.exploit-db.com/exploits/45262/
Exploit https://www.exploit-db.com/exploits/45367/
Third Party Advisory https://www.oracle.com/security-alerts/cpujul2020.html
Patch https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Third Party Advisory http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution....
and 19 more references
74
/ 100
critical-risk
Severity 24/34 · High
Exploitability 34/34 · Critical
Exposure 16/34 · Moderate