The Apache Software Foundation over the weekend announced security updates that address a critical-severity file upload vulnerability in the Struts 2 open source development framework, warning that it could be exploited to execute arbitrary code remotely.
The issue, tracked as CVE-2023-50164, is described as a flaw in the file upload logic, which could allow an “attacker to enable paths with traversals”. No technical details have been published.
“An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform remote code execution,” Apache explains in its advisory.
According to the organization, the bug impacts Struts versions 2.0.0 to 2.3.37 (which reached end of life), Struts versions 2.5.0 to 2.5.32, and Struts versions 6.0.0 to 6.3.0.
The vulnerability was patched with the release of Struts versions 2.5.33 and 6.3.0.2.
Apache has credited Steven Seeley of Source Incite for reporting the vulnerability. The researcher recommends that all Struts 2 users update to a patched release.
In a separate announcement, Apache urges all users to update to the latest web application framework versions, noting that no issues should arise when performing the upgrade.
“This is a drop-in replacement and upgrade should be straightforward. All developers are strongly advised to perform this upgrade,” the organization says.
Apache makes no mention of this vulnerability being exploited in malicious attacks, but Struts flaws have been targeted in the wild, including in attacks against the US credit reporting agency Equifax.
Related: Attackers Exploiting Critical F5 BIG-IP Vulnerability
Related: Recently Patched TeamCity Vulnerability Exploited to Hack Servers
