Bug 982572 (CVE-2016-3087) - VUL-0: CVE-2016-3087: struts: Passing malicious expression can cause RCE when Dynamic Method Invocation is enabled and REST plugin is used
Summary: VUL-0: CVE-2016-3087: struts: Passing malicious expression can cause RCE when...
Status: RESOLVED INVALID
Alias: CVE-2016-3087
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-01 13:19 UTC by Marcus Meissner
Modified: 2016-06-01 13:47 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-06-01 13:19:56 UTC 
via rh bugzilla and struts upstream

https://struts.apache.org/docs/s2-033.html

All Struts 2 developers and users

Impact of vulnerability
	

Possible Remote Code Execution

Maximum security rating
	

High

Recommendation
	

Disable Dynamic Method Invocation if possible. Alternatively upgrade to Struts 2.3.20.3, Struts 2.3.24.3 or Struts 2.3.28.1.

Affected Software
	

Struts 2.3.20 - Struts Struts 2.3.28 (except 2.3.20.3 and 2.3.24.3)

Reporter
	

Alvaro Munoz alvaro dot munoz at hpe dot com

CVE Identifier
	

CVE-2016-3087
Problem

It is possible to pass a malicious expression which can be used to execute arbitrary code on server side when Dynamic Method Invocation is enabled when using the REST Plugin.
Solution

Disable Dynamic Method Invocation when possible or upgrade to Apache Struts versions 2.3.20.3, 2.3.24.3 or 2.3.28.1.
Backward compatibility

No issues expected when upgrading to Struts 2.3.20.3, 2.3.24.3 and 2.3.28.1
Workaround

Disable Dynamic Method Invocation or implement your own version of RestActionMapper.
Comment 1 Marcus Meissner 2016-06-01 13:20:56 UTC 
this issue only affects struts2. 

we only ship struts1, which does not have the dynamic method invocation
Comment 2 Marcus Meissner 2016-06-01 13:47:29 UTC 
resolved invaliud