Is Crowd vulnerable to CVE-2018-11776 (Apache Struts)
Asked by Thomas Douglas:

Hello, I was wondering if Crowd is vulnerable to this report CVE-2018-11776? I am using Crowd 2.11.1.

The detail report implies that it only affects users of Struts 2.3 to 2.3.34 and 2.5 to 2.5.16 with certain configurations.

<https://nvd.nist.gov/vuln/detail/CVE-2018-11776>

<https://cwiki.apache.org/confluence/display/WW/S2-057>

Thanks for any help,

Byron Douglas


Answers:
author: Thomas Douglas
body: Update... there was another question in this forum related to this. Here is the response from Atlassian:

----

Thank you for reaching out to Atlassian Community!

We understand your concern regarding the new *CVE-2018-11776* vulnerability [announced](https://cwiki.apache.org/confluence/display/WW/S2-057) On August 22, by the Apache Software Foundation

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach [EOL](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html).

However, as an extra precaution that is in-line with industry best practices we will be releasing new versions of [Crowd 3.2.x and 3.1.x](https://www.atlassian.com/trust/security/bug-fix-policy) with updated version of Struts.

Hope that this answers your question.

Marcin Kempa

comments: author: masan perunovic
body: Hello, you stated that none of Atlassian products is affected, does this include Bamboo as well? Thanks.


author: Christian Pascher
body: Yes, struts 2.3.32 is used.

You can find the version with   

```
?find atlassian-crowd/ -name \*struts*.jar
```


author: Dawn Fama
body: Thank you Marcin for your reply. You stated, your security team investigated and can confirm all other Crowd versions that did not reach EOL are not affected. How about version 2.9.7?

Our security team has investigated the case and we confirm that no Atlassian products are affected by this vulnerability, including Crowd 3.2 and all other Crowd versions that did not reach [EOL](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html)

We have additional information from our security team to confirm with Atlassian. There are some

Do you know if the Struts implementation is vulnerable, according to the two conditions?

|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Apache Struts implementation are vulnerable to the reported RCE flaw if it meets the following conditions: ? The **alwaysSelectFullNamespace**flag is set to true in the Struts configuration. ? Struts configuration file contains an "action" or "url" tag that does not specify the optional namespace attribute or specifies a wildcard namespace. According to the open source research, even if an application is currently not vulnerable, "an inadvertent change to a Struts configuration file may render the application vulnerable in the future. |

Thank you for your support


Tags: vulnerability