The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

The Struts 1 plugin in Apache Struts 2 < 2.3.33 might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage class.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple Apache Struts 2 vulnerabilities.  One of the following vulnerabilities was detected on the asset:

  - CVE-2017-5638: The Jakarta Multipart parser in Apache Struts 2,   specifically 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1
  - CVE-2017-7672: Apache Struts version < 2.5.12
  - CVE-2017-9787: Apache Struts version < 2.5.12 or < 2.3.33
  - CVE-2017-9791: Struts 1 plugin in Apache Struts 2.3.x
  - CVE-2017-9793: Apache Struts < 2.3.7 - 2.3.33 & < 2.5 - 2.5.12
  - CVE-2017-9804: Apache Struts 2.3.7 -2.3.33 & 2.5 - 2.5.12
  - CVE-2017-12611: Apache Struts 2.0.1 - 2.3.33 & 2.5 - 2.5.10

The Struts 1 plugin in Apache Struts 2.3.x is affected by a remote code execution vulnerability via a malicious field value passed in a raw message to the ActionMessage class.

The version of Apache Struts running on the remote Windows host is 2.3.x. It is, therefore, potentially affected by a remote code execution vulnerability in the Struts 1 plugin showcase app in the ActionMessage class due to improper validation of user-supplied input passed via error messages. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
112762	Apache Struts 2 < 2.3.33 Remote Code Execution (S2-048)	Web App Scanning	Component Vulnerability	critical
103663	Oracle WebLogic Server Multiple Vulnerabilities	Nessus	Misc.	critical
102918	Apache Struts 2.3.x Struts 1 plugin RCE (remote)	Nessus	CGI abuses	critical
101361	Apache Struts 2.3.x Showcase App Struts 1 Plugin ActionMessage Class Error Message Input Handling RCE (S2-048)	Nessus	Misc.	critical

Detections

Analytics

CVE-2017-9791

critical

Tenable Plugins

critical

critical

critical

critical