CVE-2014-0114
published 2019-10-03CVE-2014-0114: It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader…
PriorityP279high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
96.12%
99.9th percentile
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_beanutils | <= 1.9.1 | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| debian | commons-beanutils | < commons-beanutils 1.9.2-1 (bookworm) | commons-beanutils 1.9.2-1 (bookworm) |
| redhat | jboss_operations_network | < 3.3.11 | 3.3.11 |
| redhat | struts | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP GET requests containing 'class.classLoader' or "class['classLoader']" parameter names targeting Struts 1.x or 2.x action endpoints — these are the direct exploit vectors for ClassLoader manipulation. ↗
- →Monitor for HTTP requests setting ClassLoader pipeline properties such as 'first.directory', 'first.prefix', 'first.suffix', and 'first.fileDateFormat' — these are used to redirect Tomcat access logs to write a JSP webshell. ↗
- →Watch for newly created .jsp files in the web root (webapps/ROOT) following suspicious GET requests with ClassLoader parameters — this is the webshell drop stage of the exploit. ↗
- →The exploit uses HTTP GET (not POST) with crafted query parameters to manipulate ClassLoader; detection rules should inspect GET request query strings for 'classLoader' keyword. ↗
- →The Fortinet IPS signature 'Apache.Struts.ActionServlet.Validator.Security.Bypass' covers related ClassLoader manipulation abuse in Apache Struts 1. ↗
- →The vulnerability is in the 'class' parameter which maps directly to getClass() — block or alert on any HTTP parameter named 'class' or prefixed with 'class.' in requests to Struts action endpoints. ↗
- →The root cause is in Apache Commons BeanUtils not suppressing the 'class' property during bean population — audit use of commons-beanutils-1.8.0.jar and versions through 1.9.2 in deployed applications. ↗
- ·Exploitability depends on which ClassLoader properties are exposed by the application server. Tomcat 8 exposes exploitable properties enabling RCE, but Tomcat 8 is not included in supported Red Hat products. Other servers may expose different properties with varying impact. ↗
- ·The Struts 1.x exploit parameter prefix is 'class.classLoader' while Struts 2.x uses "class['classLoader']" — detection rules must cover both variants. ↗
- ·JBoss Operations Network 3 (JON 3) had the CVE-2014-0114 fix reverted, re-exposing the vulnerability. However, later research confirmed JON did not expose the properties in an exploitable way. ↗
- ·Apache Struts 1 is End-Of-Life and will not receive patches for related ClassLoader manipulation issues; mitigation must be applied at the WAF/IPS or filter layer. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vulncheck7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r4h2-77r7-2xch: It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON)
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2019-3834 [HIGH] CWE-470 GHSA-r4h2-77r7-2xch: It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON)
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
OSV
Arbitrary code execution in Apache Commons BeanUtils
osv·2020-06-10
CVE-2014-0114 [HIGH] Arbitrary code execution in Apache Commons BeanUtils
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
GHSA
Arbitrary code execution in Apache Commons BeanUtils
ghsa·2020-06-10
CVE-2014-0114 [HIGH] CWE-20 Arbitrary code execution in Apache Commons BeanUtils
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
OSV
CVE-2014-0114: Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1
osv·2014-04-30·CVSS 7.5
CVE-2014-0114 [HIGH] CVE-2014-0114: Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
VulnCheck
Apache commons_beanutils Improper Input Validation
vulncheck·2014·CVSS 7.5
CVE-2014-0114 [HIGH] Apache commons_beanutils Improper Input Validation
Apache commons_beanutils Improper Input Validation
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Affected: Apache commons_beanutils
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.checkpoint.com/security/april-2022s-most-wanted-malware-a-shake-up-in-the-ind
Ubuntu
Apache Commons BeanUtils vulnerabilities
vendor_ubuntu·2021-03-15
CVE-2014-0114 Apache Commons BeanUtils vulnerabilities
Title: Apache Commons BeanUtils vulnerabilities
Summary: Apache Commons BeanUtils could be made to crash or run programs as your login if it
opened a specially crafted input.
It was discovered that Apache Commons BeanUtils improperly handled certain
input. An attacker could possibly use this vulnerability to cause a crash or execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
JON: struts1 reversion of fix for CVE-2014-0114
vendor_redhat·2019-10-02·CVSS 7.5
CVE-2019-3834 [HIGH] CWE-470 JON: struts1 reversion of fix for CVE-2014-0114
JON: struts1 reversion of fix for CVE-2014-0114
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vul
Red Hat
commons-beanutils: 'class' property is exposed, potentially leading to RCE
vendor_redhat·2014-05-01·CVSS 7.5
CVE-2014-3540 [HIGH] commons-beanutils: 'class' property is exposed, potentially leading to RCE
commons-beanutils: 'class' property is exposed, potentially leading to RCE
No description is available for this CVE.
Statement: MITRE has rejected this CVE ID, favoring the use of CVE-2014-0114.
This flaw was the root cause of CVE-2014-0114, a flaw in Apache Struts 1 that could lead to unauthenticated remote code execution under certains conditions. Other frameworks built on commons-beanutils, such as Apache Stripes, are likely to expose similar issues. commons-beanutils 1.9.2 has now shipped, including a specialized BeanIntrospector implementation that allows suppressing properties. Frameworks built on commons-beantutils can make use of the new pre-configured SuppressPropertiesBeanIntrospector to address this flaw.
Red Hat
1: Class Loader manipulation via request parameters
vendor_redhat·2014-04-29·CVSS 7.5
CVE-2014-0114 [HIGH] CWE-470 1: Class Loader manipulation via request parameters
1: Class Loader manipulation via request parameters
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Statement: This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. The impact of this depends on which ClassLoader properties are exposed. Exploits that lead to remote code execution have been published. These exploits rely on ClassLoader properties that are exposed on Tomca
Debian
CVE-2014-0114: commons-beanutils - Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in A...
vendor_debian·2014·CVSS 7.5
CVE-2014-0114 [HIGH] CVE-2014-0114: commons-beanutils - Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in A...
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Scope: local
bookworm: resolved (fixed in 1.9.2-1)
bullseye: resolved (fixed in 1.9.2-1)
forky: resolved (fixed in 1.9.2-1)
sid: resolved (fixed in 1.9.2-1)
trixie: resolved (fixed in 1.9.2-1)
No detection rules found.
Exploit-DB
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)
exploitdb·2014-03-06
CVE-2014-0114 Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution (Metasploit)
Apache Struts 'Apache Struts ClassLoader Manipulation Remote Code Execution',
'Description' => %q{
This module exploits a remote command execution vulnerability in Apache Struts versions
1.x (
[
'Mark Thomas', # Vulnerability Discovery
'Przemyslaw Celej', # Vulnerability Discovery
'Redsadic ', # Metasploit Module
'Matthew Hall ' # SMB target
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2014-0094'],
['CVE', '2014-0112'],
['CVE', '2014-0114'],
['URL', 'http://www.pwntester.com/blog/2014/04/24/struts2-0day-in-the-wild/'],
['URL', 'http://struts.apache.org/release/2.3.x/docs/s2-020.html'],
['URL', 'http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Update-your-Struts-1-ClassLoader-manipulation-filters/ba-p/6639204'],
['URL', 'https://github.com/rgielen/struts1filter/tree/develop
Metasploit
Apache Struts ClassLoader Manipulation Remote Code Execution
metasploit
Apache Struts ClassLoader Manipulation Remote Code Execution
Apache Struts ClassLoader Manipulation Remote Code Execution
This module exploits a remote command execution vulnerability in Apache Struts versions 1.x (<= 1.3.10) and 2.x (< 2.3.16.2). In Struts 1.x the problem is related with the ActionForm bean population mechanism while in case of Struts 2.x the vulnerability is due to the ParametersInterceptor. Both allow access to 'class' parameter that is directly mapped to getClass() method and allows ClassLoader manipulation. As a result, this can allow remote attackers to execute arbitrary Java code via crafted parameters.
Bugzilla
CVE-2019-3834 JON: struts1 reversion of fix for CVE-2014-0114
bugzilla·2019-02-15·CVSS 7.5
CVE-2019-3834 [HIGH] CVE-2019-3834 JON: struts1 reversion of fix for CVE-2014-0114
CVE-2019-3834 JON: struts1 reversion of fix for CVE-2014-0114
JON had resolved struts1 flaw CVE-2014-0114 with https://rhn.redhat.com/errata/RHSA-2014-0511.html, but reverted the fix in a later release.
Discussion:
Statement:
While the original flaw, CVE-2014-0114, was resolved as a precaution in JON 3.2.1, later further research revealed that JON did not expose the properties in an exploitable way, and was not vulnerable.
Bugzilla
CVE-2014-3540 commons-beanutils: 'class' property is exposed, potentially leading to RCE
bugzilla·2014-07-07·CVSS 7.5
CVE-2014-3540 [HIGH] CVE-2014-3540 commons-beanutils: 'class' property is exposed, potentially leading to RCE
CVE-2014-3540 commons-beanutils: 'class' property is exposed, potentially leading to RCE
It was found that commons-beanutils exposes the class property by default, with no mechanism to disable access to it. If a framework built on commons-beanutils does not otherwise suppress access to the class property, then a remote attacker could use this flaw to manipulate the ClassLoader used by the underlying container. This could lead to remote code execution under certain conditions.
Discussion:
Statement:
MITRE has rejected this CVE ID, favoring the use of CVE-2014-0114.
This flaw was the root cause of CVE-2014-0114, a flaw in Apache Struts 1 that could lead to unauthenticated remote code execution under certains conditions. Other frameworks built on commons-beanutils, such as Apache Stripes
Bugzilla
CVE-2014-0114 struts: Apache Struts 1: Class Loader manipulation via request parameters [fedora-all]
bugzilla·2014-04-29·CVSS 7.5
CVE-2014-0114 [HIGH] CVE-2014-0114 struts: Apache Struts 1: Class Loader manipulation via request parameters [fedora-all]
CVE-2014-0114 struts: Apache Struts 1: Class Loader manipulation via request parameters [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this
Bugzilla
CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters
bugzilla·2014-04-28·CVSS 7.5
CVE-2014-0114 [HIGH] CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters
CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters
It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.
The root cause of this issue is the fact that commons-beanutils exposes the class property by default, with no mechanism to disable access to it. If a framework built on commons-beanutils does not otherwise suppress access to the class property, then a remote attacker could use this flaw to manipulate the ClassLoader used by the underlying container. This could lead to remote code execution
Fortinet
The Analysis of Apache Struts 1 ActionServlet Validator Bypass (CVE-2016-1182)
blogs_fortinet·2017-10-25·CVSS 8.2
CVE-2016-1182 [HIGH] The Analysis of Apache Struts 1 ActionServlet Validator Bypass (CVE-2016-1182)
FORTIGUARD LABS THREAT RESEARCH
The Analysis of Apache Struts 1 ActionServlet Validator Bypass (CVE-2016-1182)
By Dehui Yin | October 25, 2017
Apache Struts 1 ValidatorForm is a commonly used component in the JAVA EE Web Application that requires validated form fields input by a user, such as a login form, registration form, or other information form. By configuring the validation rules, Apache Struts can validate many different kinds of fields - username, email, credit card number, etc. However, a bug in Apache Struts 1 can be used to manipulate the property of ValidatorForm so as to modify the validation rules, or even worse, cause a denial of service or execute arbitrary code in the context of the Web Application.
This potential Input Validation Bypass or Denial Of Service vulnerabil
2019-10-03
Published
Exploited in the wild