CVE-2019-3834 Code injection in struts

Medium 5.6 Published 3 Oct 2019 Updated 4 Aug 2024

Attackers can execute arbitrary code by manipulating ClassLoader properties due to a reverted security fix in JBoss Operations Network 3.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-3834?

CVE-2019-3834 is a medium-severity code injection vulnerability in RedHat struts, published on 3 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

Weakness: CWE-470

Which versions are affected by CVE-2019-3834?

It affects 1 product.

Products include Redhat Jboss Operations Network.

How do I fix CVE-2019-3834?

No fix has been published for CVE-2019-3834 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-3834 being exploited?

There is no known exploitation of CVE-2019-3834 in the wild and no public exploit code.

Sources

Also known as GHSA-r4h2-77r7-2xch.