⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2018-11776

CWE-20 — Improper Input Validation34 documents17 sources
Severity
8.1HIGH
EPSS
94.4%
top 0.01%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
6
Apache StrutsOracle Communications Policy ManagementOracle Mysql Enterprise Monitor+3 more
Timeline
PublishedAug 22
KEV addedNov 3
KEV dueMay 3
CISA Required Action: Apply updates per vendor instructions.

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages7 packages

▶NVDapache/struts2.0.4 — 2.3.35+1
▶Mavenorg.apache.struts:struts2-core2.0.4 — 2.3.35+1
▶CVEListV5apache_software_foundation/apache_struts2.3 to 2.3.34, 2.5 to 2.5.16+1
▶NVDoracle/mysql_enterprise_monitor4.0.0 — 4.0.6.5281+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation↗2018-10-18
▶
OSV
Apache Struts vulnerable to remote command execution (RCE) due to improper input validation↗2018-10-18
▶
CVEList
CVE-2018-11776: Apache Struts versions 2↗2018-08-22
▶
VulnCheck
Apache Struts Remote Code Execution Vulnerability↗2018
▶

💥Exploits & PoCs

4
Exploit-DB
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)↗2018-09-10
▶
Exploit-DB
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)↗2018-08-26
▶
Exploit-DB
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)↗2018-08-25
▶
Nuclei
Apache Struts2 S2-057 - Remote Code Execution
▶

🔍Detection Rules

10
Suricata
ET EXPLOIT Apache Struts memberAccess and getWriter inbound OGNL injection remote code execution attempt↗2018-09-05
▶
Suricata
ET EXPLOIT Apache Struts getWriter and opensymphony inbound OGNL injection remote code execution attempt↗2018-09-05
▶
Suricata
ET EXPLOIT Apache Struts memberAccess and opensymphony inbound OGNL injection remote code execution attempt↗2018-09-05
▶
Suricata
ET WEB_SPECIFIC_APPS Apache Struts inbound .getClass OGNL injection remote code execution attempt↗2018-08-24
▶
Suricata
ET WEB_SPECIFIC_APPS Apache Struts inbound .getWriter OGNL injection remote code execution attempt↗2018-08-24
▶

📋Vendor Advisories

4
CISA
Apache Struts Remote Code Execution Vulnerability↗2021-11-03
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Reporting Framework (Apache Struts 2) — CVE-2018-11776↗2020-07-15
▶
Cisco
Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018↗2018-08-23
▶
Red Hat
struts2: Using specific results and namespaces can result in a remote code execution↗2018-08-22
▶

🕵️Threat Intelligence

9
Tenable
Cisco Critical Advisories for September Includes Patch for Struts Vulnerability↗2018-09-05
▶
Volexity
Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner↗2018-08-27
▶
Volexity
Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner↗2018-08-27
▶
Qualys
Security News: Ransomware, Struts Bug, Android Spyware | Qualys↗2018-08-27
▶
Qualys
Security News: Hackers Aim Ransomware at Big Cos., as Experts Call for Swift Patching of Struts Bug↗2018-08-27
▶

💬Community

1
Bugzilla
CVE-2018-11776 struts2: Using specific results and namespaces can result in a remote code execution↗2018-08-22
▶
CVE-2018-11776 (HIGH CVSS 8.1) | Apache Struts versions 2.3 to 2.3.3 | cvebase.io