An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
The attacker manipulates HTTP request parameters responsible for file upload to bypass target path restrictions (path traversal, CWE-552 — improper access control to resources on the server side). As a result, it is possible to save a file in an unexpected location on the server. If the file is placed in a directory accessible by the application server, it can be subsequently executed as server code, leading to full RCE.
An unauthenticated attacker can gain full control over the application server — read confidential data, modify it, and execute arbitrary system commands (RCE).
Apache Struts must be updated to version 2.5.33 or 6.3.0.2 or newer. The vendor clearly indicates these versions as containing the security patch.
Apache Struts in versions prior to 2.5.33 and prior to 6.3.0.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Struts
APPApache2.0.0 – 2.5.33 (excl.)6.0.0 – 6.3.0.2 (excl.)
Related vulnerabilities
RCE w Apache Struts 2 poprzez wymuszoną ewaluację OGNL
RCE w pluginie Struts 1 dla Apache Struts 2 (S2-048)
RCE w Apache Struts 2 poprzez błędną obsługę nagłówków HTTP (Jakarta Multipart parser)
Apache Struts 2: RCE przez prefiks action/redirect w parametrach
Apache Struts: RCE przez OGNL injection w ExceptionDelegator