CVE-2018-11776 Apache Struts Remote Code Execution
Attackers can achieve remote code execution in Apache Struts when alwaysSelectFullNamespace is enabled and specific tag configurations are used.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11776?
CVE-2018-11776 is a high-severity code injection vulnerability in Apache Struts, published on 22 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Which versions are affected by CVE-2018-11776?
4 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.struts:struts2-core Maven | From 2.0.4 | 2.3.35 |
org.apache.struts:struts2-core Maven | From 2.0.4 | 2.3.35 |
org.apache.struts:struts2-core Maven | From 2.5 | 2.5.17 |
org.apache.struts:struts2-core Maven | From 2.5 | 2.5.17 |
Products include Apache Struts, Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Snapcenter, Oracle Communications Policy Management and 2 more.
How do I fix CVE-2018-11776?
Upgrade org.apache.struts:struts2-core to a fixed version for your release line: 2.3.35 or 2.5.17. US federal agencies must fix it by 3 May 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-11776 being exploited?
Yes. Attackers have exploited CVE-2018-11776 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 17 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-cr6j-3jp9-rw65.