Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-4879

Apache Struts 2 Remote Code Execution (CVE-2017-5638)

XMLWordPrintable

      Description
      Crowd used a version of Struts 2 that was vulnerable to CVE-2017-5638. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Crowd.

      Affected versions:

      • All versions of Crowd from 2.8.3 before 2.9.7 (the fixed version for 2.9.x), from version 2.10.1 before 2.10.3 (the fixed version for 2.10.x) and from version 2.11.0 before 2.11.1 (the fixed version for 2.11.x) are affected by this vulnerability.

      Fix:

       Hotfix:
      The preferred fix is to upgrade Crowd to a version that's not vulnerable (see the Fix section). If you cannot schedule an upgrade immediately, and are using Crowd 2.10 or 2.11, you can replace the affected library as a temporary workaround.

      To replace the library:

      1. Stop Crowd
      2. Download struts2-core-2.3.32.jar
      3. Remove all existing copies of struts2-core-2.3.29.jar: 
        ./crowd-openidclient-webapp/WEB-INF/lib/struts2-core-2.3.29.jar
./crowd-openidserver-webapp/WEB-INF/lib/struts2-core-2.3.29.jar
./crowd-webapp/WEB-INF/lib/struts2-core-2.3.29.jar
./demo-webapp/WEB-INF/lib/struts2-core-2.3.29.jar
      4. Copy the downloaded struts2-core-2.3.32.jar into each of the lib/ directories you removed the jar from
      5. Restart Crowd

      This temporary solution is provided only for your convenience and an upgrade to an official Crowd release should be scheduled as soon as possible.

      For additional details see the full advisory.

          Form Name

            [CWD-4879] Apache Struts 2 Remote Code Execution (CVE-2017-5638)

            Support Team [Clearvision] added a comment -

            Thank you Lukasz

            Support Team [Clearvision] added a comment - Thank you Lukasz

            Lukasz Pater added a comment -

            einkauf13 For Crowd versions 2.10.x and 2.11.x the struts2-core.jar can be replaced as a temporary hotfix. I've updated the issue with the steps required.

            security+atlassian1282683442 filtering requests by Content-Type as described should not cause any side-effects, but might not be enough to guard against all variants of the attack. Either upgrading to a version that's not vulnerable or applying the hotfix is advised.

            Lukasz Pater added a comment - einkauf13 For Crowd versions 2.10.x and 2.11.x the struts2-core.jar can be replaced as a temporary hotfix. I've updated the issue with the steps required. security+atlassian1282683442 filtering requests by Content-Type as described should not cause any side-effects, but might not be enough to guard against all variants of the attack. Either upgrading to a version that's not vulnerable or applying the hotfix is advised.

            Security Team at Clearvision added a comment -

            Hi,

            Can you advise if the following workaround for Apache + mod_rewrite would be OK and not cause any side effects ?

            RewriteCond %{HTTP:Content-type} [$\#()%}{]
RewriteRule . [F,L]

            Source: http://stackoverflow.com/questions/42720926/mitigating-cve-2017-5638-apache-struts2-vulnerability

            Thank you.

            Security Team at Clearvision added a comment - Hi, Can you advise if the following workaround for Apache + mod_rewrite would be OK and not cause any side effects ? RewriteCond %{HTTP:Content-type} [$\#()%}{] RewriteRule . [F,L] Source:  http://stackoverflow.com/questions/42720926/mitigating-cve-2017-5638-apache-struts2-vulnerability Thank you.

            IT Team added a comment -

            Is there an option as a temporary fix to replace the vulnerable struts-library like in Bamboo?
            https://jira.atlassian.com/browse/BAM-18242?src=confmacro&_ga=1.226328402.937700539.1475566115

             

            IT Team added a comment - Is there an option as a temporary fix to replace the vulnerable struts-library like in Bamboo? https://jira.atlassian.com/browse/BAM-18242?src=confmacro&_ga=1.226328402.937700539.1475566115  

              Unassigned Unassigned
              aminozhenko alexmin (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: