# MA-706.092018: MyCERT Advisory - Apache Struts Remote Code Execution (RCE) Vulnerabilities

**Date:** 30 Aug 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-706.092018  
**Advisory ID:** MA-706.092018

---

**1.0 Introduction**
Apache Struts is an open-source web application framework for developing enterprise Java EE web application. RCE vulnerabilities happened due to affected software inadequately validates user-supplied, when using results with no namespace and its upper actions have no wildcard namespace and vice versa to the URL tag.
**2.0 Impact**
Attacker could execute the arbitrary code in the security towards affected application on targeted system after successfully send request that contains malicious input to the affected applicants for processing.
**3.0 Affected Products**
• Site that runs Apache Struts 2.3 — 2.3.34
• Site that runs Apache Struts 2.5 — 2.5.16
Note: The unsupported Struts versions may also affected.
**4.0 Recommendations**
Users and administrators are recommended to do necessary updates by following either of these instructions below:
• If the site is running Apache Struts 2.3 — 2.3.34 upgrade to Apache Struts 2.3.35
<https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.35>
• If the site is running Apache Struts 2.5 — 2.5.16 upgrade to Apache Struts 2.5.17
<https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.17>
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#dcbfa5beb9aee5e5e59cbfa5beb9aeafb9bfa9aeb5a8a5f2b1a5) or [[email protected]](/cdn-cgi/l/email-protection#deb3a7bdbbacaa9eb3a7bdbbacaaf0b1acb9f0b3a7)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or Android Users
**5.0 References**
• <https://nvd.nist.gov/vuln/detail/CVE-2018-11776>
• <https://thehackernews.com/2018/08/apache-struts-vulnerability.html>
• <https://cwiki.apache.org/confluence/display/WW/S2-057>
• <https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-critical-apache-struts-2-remote-code-execution-vulnerability-cve-2018-11776>