JPCERT-AT-2017-0009 JPCERT/CC 2017-03-09(Initial) 2017-03-21(Update) <<< JPCERT/CC Alert 2017-03-09 >>> Vulnerability in Apache Struts 2 (S2-045) https://www.jpcert.or.jp/english/at/2017/at170009.html I. Overview Apache Struts 2 provided by the Apache Software Foundation contains a vulnerability (S2-045/CVE-2017-5638). A remote attacker sending a specially crafted HTTP request leveraging the vulnerability may execute arbitrary code on the server that runs an application using Apache Struts 2 (Struts application). For more details on the vulnerability, please refer to the information provided by the Apache Software Foundation. Proof-of-Concept (PoC) code for this vulnerability has been already made public, and JPCERT/CC's test of this code confirmed that arbitrary code was executed with the execution privilege of the application server which runs the Struts application. This vulnerability originates in the processing of Jakarta Multipart parser *1) used as default in Struts 2, and JPCERT/CC observed that Apache Struts 2 is affected by this vulnerability if the parser is not changed from the default setting in Struts configuration file (e.g. struts.xml). *1) Jakarta Multipart parser Jakarta Multipart parser is a parser programmed to process multipart/form-data format requests. This parser is used under the default settings. https://cwiki.apache.org/confluence/display/WW/File+Upload#FileUpload-AlternateLibraries Apache Software Foundation has provided versions of the software that address the vulnerability. For those using an affected version of the software, it is strongly recommended to quickly resolve the issue based on information provided in "V. Solution". ** Update: Mar 17, 2017 Update *************************************** JPCERT/CC has been receiving reports on the attacks which seem to exploit the vulnerability. If you are using any of the affected versions of the software on the servers running Struts Application, please implement the countermeasures described in "V. Solution". ********************************************************************** ** Update: Mar 21, 2017 Update *************************************** Apache Software Foundation has released a Security Bulletin (S2-046) related to the vulnerability. The CVE Identifier (CVE-2017-5638) is the same as the Security Bulletin (S2-045) which was already released before, and there is no further update to the software version which was introduced in the previous advisory. The new advisory introduces two plugins for fixing Jakarta Multipart parser/JakartaStreamMultiPartRequest as additional workarounds. Possible RCE when performing file upload based on Jakarta Multipart parser (similar to S2-045) https://struts.apache.org/docs/s2-046.html ********************************************************************** II. A Possible Attack Scenario Sending a specially crafted HTTP request leveraging the vulnerability to a Struts application may result in arbitrary code execution on the server which runs the Struts application. III. Affected Systems The following versions are affected by this vulnerability: - Apache Struts versions 2.3.5 through 2.3.31 - Apache Struts versions 2.5 through 2.5.10 IV. Test Results from JPCERT/CC JPCERT/CC tested the PoC code that leverages this vulnerability. [Test content] - Deploy a sample application that uses Apache Struts 2 on Apache Tomcat. We examined if arbitrary code is executed by sending a specially crafted HTTP request using the proof-of-concept code. [Test Environment] - CentOS 7.1 - Apache Tomcat 8.5.11 - Java 1.8.0_121 [Test Results] - We observed that arbitrary code execution is possible on a server that uses the affected versions of Apache Struts 2. - We observed that arbitrary code is not executed on a server that uses the versions of Apache Struts 2 where the vulnerability has been addressed. - We observed that arbitrary code is not executed on a server when the default parser has been switched from Jakarta Multipart parser to Jakarta StreamMultiPartRequest. - Apache Struts 2.3.31 | affected | - Apache Struts 2.3.31(changed parser) | not affected | - Apache Struts 2.3.32 | not affected | - Apache Struts 2.5.10 | affected | - Apache Struts 2.5.10.1 | not affected | In addition, JPCERT/CC observed that arbitrary code is not executed on a server if malicious requests are restricted using servlet filter *2). *2) Function for preprocessing of requests to Web application (servlet). (Japanese) http://otndnld.oracle.co.jp/document/products/as10g/1013/doc_cd/web.1013/B28596-01/filters.htm V. Solution Apache Software Foundation has released a version addressing this vulnerability. It is recommended to update to this latest version after thorough testing. - Apache Struts 2.3.32 - Apache Struts 2.5.10.1 According to Apache Software Foundation, switching the default parser from Jakarta Multipart parser to JakartaMurtiPartRequest is also recommended as a countermeasure. If it is difficult to update the software immediately, please consider applying the solution. Other available parsers include JakartaStreamMultiPartRequest, which is programmed by default in Struts 2.3.18 and greater, and Pell Multipart Plugin as an additional plugin, which can be configured by setting the parameter "struts.multipart.parser" in Struts configuration files (e.g. struts.xml). For details about configuration procedures, please refer to the information below. https://cwiki.apache.org/confluence/display/WW/File+Upload#FileUpload-AlternateLibraries ** Update: Mar 17, 2017 Update *************************************** JPCERT/CC was informed that JakartaStreamMultiPartRequest, recommended as an alternative for Jakarta Multipart parser, is also affected by this vulnerability and may be leveraged for attacks. JPCERT/CC confirmed that attacks can be still launched under the environment with the affected version of software, even after switching the parser to JakartaStreamMultiPartRequest. JPCERT/CC strongly recommends updating the software to the latest version as soon as possible. In addition, Apache Software Foundation has announced that disabling File Upload Interceptor is another workaround. This will only work for Struts 2.5.8 - 2.5.10. Please conduct sufficient verification before applying the workaround. S2-045 : Possible Remote Code Execution when performing file upload based on Jakarta Multipart parser. Workaround https://struts.apache.org/docs/s2-045.html ********************************************************************** ** Update: Mar 21, 2017 Update *************************************** The CVE Identifier (CVE-2017-5638) of the vulnerability specified in the Security Bulletin (S2-046) is the same as Security Bulletin (S2-045) which was already released before, and there is no further update to the software version which was introduced in the previous advisory. However, two plugins for fixing Jakarta Multipart parser/ JakartaStreamMultiPartRequest as additional workarounds. For more details, please refer to the information from Apache Software Foundation. Struts Extras https://struts.apache.org/download.cgi#struts-extras ********************************************************************** VI. References Apache Struts 2 Documentation Version Notes 2.3.32 https://struts.apache.org/docs/version-notes-2332.html Apache Struts 2 Documentation Version Notes 2.5.10.1 https://struts.apache.org/docs/version-notes-25101.html Apache Struts 2 Documentation S2-045 : Possible Remote Code Execution when performing file upload based on Jakarta Multipart parser. https://struts.apache.org/docs/s2-045.html Apache Struts 2 Documentation Alternate Libraries https://cwiki.apache.org/confluence/display/WW/File+Upload#FileUpload-AlternateLibraries Information-technology Promotion Agency Vulnerability in Apache Struts 2 (CVE-2017-5638) (S2-045) (Japanese) https://www.ipa.go.jp/security/ciadr/vul/20170308-struts.html JVNVU#93610402 Apache Struts 2 contains vulnerability which may execute arbitrary code (Japanese) https://jvn.jp/vu/JVNVU93610402/ ** Update: Mar 21, 2017 Update *************************************** Apache Struts 2 Documentation Possible RCE when performing file upload based on Jakarta Multipart parser (similar to S2-045) https://struts.apache.org/docs/s2-046.html Apache Software Foundation Struts Extras https://struts.apache.org/download.cgi#struts-extras ********************************************************************** If you have any information regarding this alert, please contact JPCERT/CC. ________ Revision History 2017-03-09 First edition 2017-03-17 Updated "I. Overview" and "V. Solution" 2017-03-21 Updated "I. Overview", "V. Solution" and "VI. References" ====================================================================== JPCERT Coordination Center (JPCERT/CC) MAIL: info@jpcert.or.jp TEL: +81-3-3518-4600 FAX: +81-3-3518-4602 https://www.jpcert.or.jp/english/