CVE-2011-3923
published 2019-11-01CVE-2011-3923: Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
88.83%
99.8th percentile
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | — | — |
| apache | struts | >= 2.0.0 < 2.3.1.2 | 2.3.1.2 |
| redhat | jboss_enterprise_web_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect OGNL injection via parentheses in HTTP parameter values — the regex in ParametersInterceptor matches top['foo'](0) as valid, allowing OGNL evaluation of String action parameters. Look for parameter values containing patterns like `(#context[` or `(#_memberAccess[` in HTTP requests. ↗
- →Flag HTTP requests to Struts .action endpoints where parameter values contain `#context["xwork.MethodAccessor.denyMethodExecution"]` or `#_memberAccess["allowStaticMethodAccess"]` — these are the canonical OGNL sandbox-bypass strings used in CVE-2011-3923 exploitation. ↗
- →Detect the two-parameter exploitation pattern: one parameter stores the OGNL payload as a String value, and a second parameter uses a dynamic function call syntax `z[(paramname)('value')]=true` to trigger evaluation. Both parameters appearing together in a single request is a strong indicator of exploitation. ↗
- →Detect the exception-based exploitation vector: numeric-typed action parameters (e.g. productId) receiving non-numeric string values that embed OGNL expressions. Struts re-evaluates the value as OGNL during type-mismatch exception handling. ↗
- →The Metasploit module uses a time-based blind check: it injects `@java.lang.Thread@sleep(N*1000)` and measures response delay. Detect anomalously slow responses to .action endpoints combined with OGNL-like parameter content as a sign of active exploitation or probing. ↗
- →The Metasploit module defaults to targeting the `username` parameter for injection. Monitor for OGNL payloads in login-related parameters (e.g. `username`) on Struts .action endpoints. ↗
- ·Vulnerability affects Apache Struts versions 2.0.0 through 2.3.1.1 only; version 2.3.1.2 contains the fix. Detections should be scoped to unpatched deployments in this range. ↗
- ·Red Hat products do not ship or enable Struts 2 in final builds, but struts2-core JARs were included in source packages for Fuse Service Works 6.0.0 and Single Sign On 7.3.0+. Only customers who built artifacts from source are at risk. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Struts ParameterInterceptor vulnerability allows remote command execution
osv·2022-04-22
CVE-2011-3923 [CRITICAL] Struts ParameterInterceptor vulnerability allows remote command execution
Struts ParameterInterceptor vulnerability allows remote command execution
Regular expression in ParametersInterceptor matches `top['foo'](0)` as a valid expression, which OGNL treats as `(top['foo'])(0)` and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated as an OGNL expression and since OGNL statement is in HTTP parameter value attacker can use blacklisted characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the ParametersInterceptor and OGNL library protections.
GHSA
Struts ParameterInterceptor vulnerability allows remote command execution
ghsa·2022-04-22
CVE-2011-3923 [CRITICAL] CWE-732 Struts ParameterInterceptor vulnerability allows remote command execution
Struts ParameterInterceptor vulnerability allows remote command execution
Regular expression in ParametersInterceptor matches `top['foo'](0)` as a valid expression, which OGNL treats as `(top['foo'])(0)` and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated as an OGNL expression and since OGNL statement is in HTTP parameter value attacker can use blacklisted characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the ParametersInterceptor and OGNL library protections.
No detection rules found.
Exploit-DB
Shopizer 1.1.5 - Multiple Vulnerabilities
exploitdb·2014-07-14
CVE-2014-4965 Shopizer 1.1.5 - Multiple Vulnerabilities
Shopizer 1.1.5 - Multiple Vulnerabilities
---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory
title: Multiple critical vulnerabilities in Shopizer webshop
product: Shopizer
vulnerable version: 1.1.5 and below
fixed version: v2 (new codebase)
impact: critical
homepage: http://www.shopizer.com/
found: 2012-01-10
by: Johannes Dahse, Johannes Greil
SEC Consult Vulnerability Lab
https://www.sec-consult.com
Vendor description:
- -------------------
Shopizer is an open source java shopping cart and e-commerce content
management software (CMS). The system is built on Struts 2, Hibernate and
Spring. JQuery ui and ajax are heavily used on the ui as well as DWR and
Struts2-jQuery plug-in. (http://www.shopizer.com/)
Vulnerability overview/description
Exploit-DB
Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)
exploitdb·2013-03-22
CVE-2011-3923 Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)
Apache Struts - 'ParametersInterceptor' Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Apache Struts ParametersInterceptor Remote Code Execution',
'Description' => %q{
This module exploits a remote command execution vulnerability in Apache Struts
versions
[
'Meder Kydyraliev', # Vulnerability Discovery and PoC
'Richard Hicks ', # Metasploit Module
'mihi' #ARCH_JAVA support
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2011-3923'],
[ 'OSVDB', '78501'],
[ 'URL', 'http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-
Metasploit
Apache Struts ParametersInterceptor Remote Code Execution
metasploit
Apache Struts ParametersInterceptor Remote Code Execution
Apache Struts ParametersInterceptor Remote Code Execution
This module exploits a remote command execution vulnerability in Apache Struts versions < 2.3.1.2. This issue is caused because the ParametersInterceptor allows for the use of parentheses which in turn allows it to interpret parameter values as OGNL expressions during certain exception handling for mismatched data types of properties which allows remote attackers to execute arbitrary Java code via a crafted parameter.
http://seclists.org/fulldisclosure/2014/Jul/38http://www.exploit-db.com/exploits/24874http://www.securityfocus.com/bid/51628http://www.securitytracker.com/id?1026575https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923https://exchange.xforce.ibmcloud.com/vulnerabilities/72585https://security-tracker.debian.org/tracker/CVE-2011-3923http://seclists.org/fulldisclosure/2014/Jul/38http://www.exploit-db.com/exploits/24874http://www.securityfocus.com/bid/51628http://www.securitytracker.com/id?1026575https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923https://exchange.xforce.ibmcloud.com/vulnerabilities/72585https://security-tracker.debian.org/tracker/CVE-2011-3923
2019-11-01
Published