Remote Code Execution Vulnerabilities in Apache Struts 2 (CVE-2019-0230 and CVE-2019-0233)

Last updated: 2020-12-15 15:20:27

    On August 13, 2020, Tencent Security detected that Apache Struts issued a security advisory for the S2-059 Struts remote code execution vulnerability and S2-060 Struts denial of service vulnerability.

    Vulnerability Details

    Apache Struts 2 is a web framework for developing Java EE network applications.

    • S2-059 Struts remote code execution vulnerability (CVE-2019-0230): in cases such as improper use of certain tags, OGNL expression injection may exist, thereby causing a remote code execution vulnerability. 
    • S2-060 Struts denial of service vulnerability (CVE-2019-0233): it may cause denial of service attacks when files are uploaded and manipulated.

    Affected Versions

    Apache Struts 2.0.0–2.5.20

    Secure Versions

    Apache Struts >= 2.5.22

    Suggestions for Fix

    Based on the vulnerability information, Tencent Security recommends you:

    • Upgrade the Apache Struts framework to the latest version.
    • Use Tencent Cloud WAF, an AI-based one-stop web security solution. The most typical characteristic of the S2-059 vulnerability is that the vulnerability uses the OGNL language. The Tencent Security technical team conducted a targeted study on OGNL expressions, blocked attacks against such expressions, and integrated the defense capability into WAF. Therefore, as long as the vulnerability is attacked based on OGNL expressions, WAF can directly block them.
      In addition, the intelligent engine of WAF also provides intelligent defense against SQL, XSS, and command execution attacks. Backed by AI technologies, it can reasonably and effectively block unknown security vulnerabilities for improved business continuity.

    References

    Official advisory:

    Was this page helpful?

    Was this page helpful?

    • Not at all
    • Not very helpful
    • Somewhat helpful
    • Very helpful
    • Extremely helpful
    Send Feedback
    Help