CVE-2016-1181: Insufficient Information (NVD-CWE-noinfo)
value: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2016-07-04T22:59Z
Repository: https://github.com/kawasima/struts1-forever
Language: Markdown
Files changed: README.md, src/share/org/apache/struts/action/ActionServlet.java
Commit date: 2016-06-08 11:38:30 +0900
Commit message: Fixed CVE-2016-1181 and CVE-2016-1182

Diff: diff --git a/README.md b/README.md
index ed72d419..8b31c284 100644
--- a/README.md
+++ b/README.md
@@ -1,16 +1,23 @@
-STRUTS
-======
+# STRUTS
 
 ![build status](https://circleci.com/gh/kawasima/struts1-forever.png?style=shield&circle-token=8f99c0e6c923ca570acda8c3640446fdacad2a47)
 
 This struts1's fork is for maintenance to fix the vulnerabilities.
 
-$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
+## Requirements
 
-Introduction (Original)
-------------------------
+Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
+Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.
+
+## Fixed vulnerabilities
+
+- CVE-2014-0114
+- CVE-2016-1181
+- CVE-2016-1182
+
+## Introduction (Original)
 
 This subproject contains the source code for the "Struts" application support
 package, consisting of the following major components:
 
 - Controller servlet with action mapping technology, implementing the Model-
diff --git a/src/share/org/apache/struts/action/ActionServlet.java b/src/share/org/apache/struts/action/ActionServlet.java
index 6ff52e44..925af5b6 100755
--- a/src/share/org/apache/struts/action/ActionServlet.java
+++ b/src/share/org/apache/struts/action/ActionServlet.java
@@ -1,16 +1,16 @@
 /*
- * $Id$ 
+ * $Id$
  *
  * Copyright 2000-2005 The Apache Software Foundation.
- * 
+ *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
@@ -22,14 +22,11 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.net.MalformedURLException;
 import java.net.URL;
-import java.util.ArrayList;
-import java.util.Enumeration;
-import java.util.Iterator;
-import java.util.MissingResourceException;
+import java.util.*;
 
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
 import javax.servlet.UnavailableException;
 import javax.servlet.http.HttpServlet;
@@ -325,20 +322,20 @@ public class ActionServlet extends HttpServlet {
         // to the developer
         try {
             initInternal();
             initOther();
             initServlet();
-    
+
             getServletContext().setAttribute(Globals.ACTION_SERVLET_KEY, this);
             initModuleConfigFactory();
             // Initialize modules as needed
             ModuleConfig moduleConfig = initModuleConfig("", config);
             initModuleMessageResources(moduleConfig);
             initModuleDataSources(moduleConfig);
             initModulePlugIns(moduleConfig);
             moduleConfig.freeze();
-    
+
             Enumeration names = getServletConfig().getInitParameterNames();
             while (names.hasMoreElements()) {
                 String name = (String) names.nextElement();
                 if (!name.startsWith("config/")) {
                     continue;
@@ -349,27 +346,27 @@ public class ActionServlet extends HttpServlet {
                 initModuleMessageResources(moduleConfig);
                 initModuleDataSources(moduleConfig);
                 initModulePlugIns(moduleConfig);
                 moduleConfig.freeze();
             }
-    
+
             this.initModulePrefixes(this.getServletContext());
-    
+
             this.destroyConfigDigester();
         } catch (UnavailableException ex) {
             throw ex;
         } catch (Throwable t) {
 
             // The follow error message is not retrieved from internal message
-            // resources as they may not have been able to have been 
+            // resources as they may not have been able to have been
             // initialized
             log.error("Unable to initialize Struts ActionServlet due to an "
                 + "unexpected exception or error thrown, so marking the "
                 + "servlet as unavailable.  Most likely, this is due to an "
                 + "incorrect or missing library dependency.", t);
             throw new UnavailableException(t.getMessage());
-        }    
+        }
     }
 
     /**
      * <p>Saves a String[] of module prefixes in the ServletContext under
      * Globals.MODULE_PREFIXES_KEY.  <strong>NOTE</strong> -
@@ -724,17 +721,17 @@ public class ActionServlet extends HttpServlet {
             // If the config isn't in the servlet context, try the class loader
             // which allows the config files to be stored in a jar
             if (url == null) {
                 url = getClass().getResource(path);
             }
-            
+
             if (url == null) {
                 String msg = internal.getMessage("configMissing", path);
                 log.error(msg);
                 throw new UnavailableException(msg);
             }
-	    
+
             InputSource is = new InputSource(url.toExternalForm());
             input = url.openStream();
             is.setByteStream(input);
             digester.parse(is);
 
@@ -1058,12 +1055,17 @@ public class ActionServlet extends HttpServlet {
      * <p>Initialize other global characteristics of the controller servlet.</p>
      *
      * @exception ServletException if we cannot initialize these resources
      */
     protected void initOther() throws ServletException {
+        HashSet suppressProperties = new HashSet();
+        suppressProperties.add("class");
+        suppressProperties.add("multipartRequestHandler");
+        suppressProperties.add("resultValueMap");
+
         PropertyUtils.addBeanIntrospector(
-                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
+                new SuppressPropertiesBeanIntrospector(suppressProperties));
         PropertyUtils.clearDescriptors();
 
         String value = null;
         value = getServletConfig().getInitParameter("config");
         if (value != null) {

Vulnerable code: STRUTS
======
$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
Introduction (Original)
 * $Id$ 
 * 
 * 
 * 
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.MissingResourceException;
    
    
    
    
            // resources as they may not have been able to have been 
        }    
            
	    
                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
Fixed code: # STRUTS
## Requirements
Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.

## Fixed vulnerabilities

- CVE-2014-0114
- CVE-2016-1181
- CVE-2016-1182

## Introduction (Original)
 * $Id$
 *
 *
 *
import java.util.*;




            // resources as they may not have been able to have been
        }


        HashSet suppressProperties = new HashSet();
        suppressProperties.add("class");
        suppressProperties.add("multipartRequestHandler");
        suppressProperties.add("resultValueMap");

                new SuppressPropertiesBeanIntrospector(suppressProperties));