Severity: High
A high-severity vulnerability has been disclosed affecting Apache Struts 2, a widely used open-source framework for developing Java web applications.
The vulnerability, tracked as CVE-2016-3081, is a remote code execution vulnerability in Apache Struts 2, specifically in the Dynamic Method Invocation (DMI) feature. A flaw in the way Struts 2 processes action requests when DMI is enabled means that a remote, unauthenticated attacker can craft a specially formed request which contain commands to be executed by the framework with the privileges of the web application server process. This allows an attacker to execute arbitrary operating system commands on the affected host without requiring any authentication or user interaction. Public exploit code is available for this vulnerability, and it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalogue, significantly increasing the risk to unpatched systems.
As part of Beeks’ commitment to supporting operational resilience and cyber risk management, this advisory is intended to help organisations assess exposure and implement appropriate mitigations.
Affected software:
- Apache Struts 2.3.19 – 2.3.20.2
- Apache Struts 2.3.21 – 2.3.24.1
- Apache Struts 2.3.25 – 2.3.28
Immediate Recommended Actions:
- Upgrade Apache Struts 2 to a version that is not affected by this vulnerability — this is the primary and most effective remediation. Consult the Apache Struts security bulletin S2-032 for the recommended fixed release.
- Where immediate upgrading is not possible, disable Dynamic Method Invocation (DMI) in your Struts 2 configuration by setting struts.enable.DynamicMethodInvocation to false in struts.properties or your equivalent configuration file, as DMI must be enabled for this vulnerability to be exploitable.
- Audit affected applications for indicators of compromise, including unexpected process execution originating from the web application server process, as public exploit code exists and this vulnerability has been actively exploited in the wild.
Further Information:
For detailed information on the vulnerability, please refer to the following sources:
https://nvd.nist.gov/vuln/detail/CVE-2016-3081
http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
For detailed information on how to apply the security patch for this vulnerability, please refer to:
https://struts.apache.org/docs/s2-032.html
https://www.exploit-db.com/exploits/39756/
https://packetstorm.news/files/id/136856
https://struts.apache.org/docs/s2-032.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081
If you have any questions or require further assistance, please contact [email protected] or reach out to your Beeks account representative.
This advisory is issued to help ensure the security of your systems and prevent unauthorised access to sensitive data. Beeks remains committed to providing timely security information and support to safeguard your infrastructure.
Beeks will continue to monitor this and related vulnerabilities and provide updates through our Security Advisory Feed.
