Home > Security Bulletins > S2-001

Summary

Remote code exploit on form validation error

Who should read this

All Struts 2 developers

Impact of vulnerability

Remote code execution

Maximum security rating

Critical

Recommendation

Developers should immediately upgrade to Struts 2.0.9 or upgrade to XWork 2.0.4

Affected Software

WebWork 2.1 (with altSyntax enabled), WebWork 2.2.0 - WebWork 2.2.5, Struts 2.0.0 - Struts 2.0.8

Non-Affected Software

WebWork 2.0, WebWork 2.1 (with altSyntax disabled, which is the default)

Original JIRA Ticket

WW-2030

Problem

The 'altSyntax' feature of WebWork 2.1+ and Struts 2 allows OGNL expressions to be inserted into text strings and is processed recursively. This allows a malicious user to submit a string, usually through an HTML text field, containing an OGNL expression that will then be executed by the server if the form validation has failed. For example, say we had this form that required the 'phoneNumber' field to not be blank:

<s:form action="editUser">
  <s:textfield name="name" />
  <s:textfield name="phoneNumber" />
</s:form>

The user could leave the 'phoneNumber' field blank to trigger the validation error, then populate the 'name' field with %{1+1}. When the form is re-displayed to the user, the value of the 'name' field will be '2'. The reason is the value field is, by default, processed as %{name}, and since OGNL expressions are evaluated recursively, it is evaluated as if the expression was %{%{1+1}}.

The OGNL parsing code is actually in XWork and not in WebWork 2 or Struts 2.

Solution

As of XWork 2.0.4, the OGNL parsing is changed so that it is not recursive. Therefore, in the example above, the result will be the expected %{1+1}. You can either obtain the WebWork 2.0.4 or Struts 2.0.9, which contains the corrected XWork library. Alternatively, you can obtain the patch and apply it to the XWork source code yourself.