BREAKING AT&T Data Breach: ‘Nearly All’ Wireless Customers Exposed in Massive Hack
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Apache Patches Critical RCE Vulnerability in Struts 2

Apache has addressed a critical-severity Struts 2 file upload vulnerability that could lead to remote code execution.

The Apache Software Foundation over the weekend announced security updates that address a critical-severity file upload vulnerability in the Struts 2 open source development framework, warning that it could be exploited to execute arbitrary code remotely.

The issue, tracked as CVE-2023-50164, is described as a flaw in the file upload logic, which could allow an “attacker to enable paths with traversals”. No technical details have been published.

“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution,” Apache explains in its advisory.

According to the organization, the bug impacts Struts versions 2.0.0 to 2.3.37 (which reached end of life), Struts versions 2.5.0 to 2.5.32, and Struts versions 6.0.0 to 6.3.0.

The vulnerability was patched with the release of Struts versions 2.5.33 and 6.3.0.2.

Apache has credited Steven Seeley of Source Incite for reporting the vulnerability. The researcher recommends that all Struts 2 users update to a patched release.

In a separate announcement, Apache urges all users to update to the latest web application framework versions, noting that no issues should arise when performing the upgrade.

“This is a drop-in replacement and upgrade should be straightforward. All developers are strongly advised to perform this upgrade,” the organization says.

Advertisement. Scroll to continue reading.

Apache makes no mention of this vulnerability being exploited in malicious attacks, but Struts flaws have been targeted in the wild, including in attacks against the US credit reporting agency Equifax.

Related: Attackers Exploiting Critical F5 BIG-IP Vulnerability

Related: Recently Patched TeamCity Vulnerability Exploited to Hack Servers

Related: Critical Vulnerability Found in Ray AI Framework

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

ICS and OT cybersecurity solutions provider TXOne Networks appoints Stephen Driggers as new CRO

Identity orchestration provider Strata Identity appoints Aldo Pietropaolo as Field CTO

Cybersecurity provider for the aviation industry Cyviation has appointed Eliran Almog as Chief Executive Officer.

More People On The Move

Expert Insights