Yet another remote code execution vulnerability in Apache’s Struts2 Framework has been discovered, leaving many with strong feelings of Deja Vu. If you’re a developer, it’s not unreasonable to be concerned about how you may spend the final weeks of 2023.

Unfortunately, the recent identification of CVE-2023-50164 in Apache Struts is similar to other vulnerabilities we’ve seen in the past, most notably the high-profile cybersecurity Struts2 vulnerability in 2017 that impacted Equifax, Log4Shell (Log4j), which came at the end of 2021, and Spring4Shell that followed shortly after.

Note: Sonatype customers using Sonatype Repository Firewall and Sonatype Lifecycle are protected from this issue. Sonatype security research conducted a deep dive analysis into the issue as it surfaced.

Understanding CVE-2023-50164

At its core, this vulnerability allows attackers to exploit a flaw in Apache Struts’ file upload system. It lets them manipulate the file upload parameters and perform path traversal. This exploitation can result in arbitrary code execution on the server, leading to various outcomes like unauthorized data access, system compromise, or even complete control over the affected systems, including placing malicious files within systems.

Taking a closer look, CVE-2023-50164 involves a vulnerability in the file upload mechanism of Apache Struts. For a non-technical audience, imagine a scenario where a security checkpoint (the file upload mechanism) is bypassed due to a loophole, allowing unauthorized access to secure areas (the server). From a technical perspective, the vulnerability lies in how Apache Struts handles a component called MultiPartRequestWrapper during file uploads. Attackers can manipulate this process to achieve path traversal, which allows them to overwrite arbitrary files, which may lead to executing arbitrary code on the server, config changes, etc.

Unique Potential Requires Quick Action

The discovery of CVE-2023-50164 has significant real-world implications. For various sectors relying on Apache Struts, the risks (Read more...)