Apache Struts 2 vulnerability discovered, as proof of concept circulates

A brand new vulnerability within the Struts 2 net utility framework can probably allow a distant attacker to execute code on programs working apps primarily based on earlier variations of the software program.

The vulnerability, introduced this week by Apache, includes a possible attacker manipulating file add parameters in what’s known as a path traversal assault. Path traversal is a broad time period, in line with Akamai senior safety researcher Sam Tinklenberg.

“On this case, using path traversals permits an attacker to add a malicious file, most certainly a webshell, exterior of the conventional add listing,” he stated. “The precise location will differ from utility to utility and have to be a legitimate path which may be accessed from the web.”

The flaw impacts solely older variations of the Struts 2 framework, and upgrading to variations 2.5.33, 6.3.0.2 or larger ought to eradicate the potential of exploitation. It was first reported by researcher Steven Seeley.

Struts’ maintainers on the Apache Software program Basis urged customers to patch instantly, saying that the replace is “a drop-in alternative, and improve must be easy.”

Including urgency to the necessity to patch is the information that proof of idea code has been noticed within the wild. A submit from the Shadowserver Basis, a nonprofit safety group that payments itself as a number one reporter and tracker of malicious web exercise, on X (previously Twitter), stated that PoC code has been seen on sensors.