Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Apache Struts2 ParametersInterceptor Remote Command Execution Vulnerability

Subscribe

Check Point Reference: CPAI-2010-141
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory SA40575
Industry Reference(s): CVE-2010-1870
Protection Provided by: Security Gateway
  • R71
  • R70
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Apache Software Foundation Struts 2.x prior to 2.2.1
OpenSymphony.com XWorks 2.x
Vulnerability Description
A command execution vulnerability exists in the web application framework Apache Struts2, a free and widely-used framework for building Java web-based applications.The vulnerability is due to insufficient input validation in the ParametersInterceptor component when parsing incoming HTTP requests. A remote attacker can leverage this vulnerability by sending a crafted HTTP request to a target system, potentially resulting in remote code execution.
Update/Patch Available
Vendor's advisory
Vulnerability Details
The vulnerability is caused due to an error in XWork, which can be exploited to execute arbitrary commands via specially crafted OGNL (Object-Graph Navigation Language) expressions.

Protection Overview
The protection will detect and block attempts to bypass object access logic in the Struts framework.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05Protection tab and select the version of your choice. 

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R70/R71

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Web Servers Apache.
2. In the right pane, double-click the Apache Struts2 ParametersInterceptor Remote Command Execution protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries: 

Attack Name: Apache Server Protection Violation
Attack Information: Apache Struts2 ParametersInterceptor remote command execution

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW 2, and select the Apache Attacks protection group
3. Click Apache Struts2 Struts2/XWork Remote Command Execution (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name:
Attacks against Apache web servers
Description: Apache Struts2 Struts2/XWork Remote Command Execution