Description
ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass EDB-32564 · remote · Nov 4, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.opensymphony:xwork | < 2.0.6 | 2.0.6 | GHSA-wxw2-2mx5-c5qf |
| Maven | com.opensymphony:xwork | >= 2.1.0, < 2.1.2 | 2.1.2 | GHSA-wxw2-2mx5-c5qf |
References
- 32495 third-party-advisory
- http://fisheye6.atlassian.com/cru/CR-9/
- http://struts.apache.org/2.x/docs/s2-003.html
- xwork-parameterinterceptor-security-bypass(46328) vdb-entry
- ADV-2008-3003 vdb-entry
- ADV-2008-3004 vdb-entry
- 32101 vdb-entry
- 32497 third-party-advisory
- http://jira.opensymphony.com/browse/XW-641
- http://issues.apache.org/struts/browse/WW-2692
- 49732 vdb-entry