Do CVE-2014-0094, CVE-2014-0112, and CVE-2014-0113 affect Struts 2 applications running on Red Hat application server products?

Solution Unverified - Updated -

Environment

  • Red Hat JBoss Enterprise Application Platform (EAP)
    • 4.x
    • 5.x
    • 6.x
  • Red Hat JBoss Web Server (JWS)
    • 1.x
    • 2.x
  • Red Hat Enterprise Linux (RHEL)
    • Tomcat 5.5 in RHEL 5
    • Tomcat 6.0 in RHEL 6

Issue

  • Do CVE-2014-0094, CVE-2014-0112, and CVE-2014-0113 affect Struts 2 applications running on Red Hat JBoss products?

  • We have a WAR deployed that bundles Struts v1 and uses struts as the Controller. https://access.redhat.com/site/solutions/869353 and https://bugzilla.redhat.com/show_bug.cgi?id=1091938 say: “This flaw allows attackers to manipulate ClassLoader properties on the server. The impact of this depends on which ClassLoader properties are exposed.” How can we determine what ClassLoader properties are exposed on our JBoss EAP servers?

Resolution

Struts 2 does not ship with any supported Red Hat product. Applications using a third-party Struts 2 library, deployed to Red Hat JBoss products, may be affected. See below for details.

These flaws allow attackers to manipulate ClassLoader properties on the server. The impact of this depends on which ClassLoader properties are exposed. Exploits for CVE-2014-0094 that lead to remote code execution have been published. These exploits rely on ClassLoader properties that are exposed on Tomcat 8, which is not included in any supported Red Hat products. However, some Red Hat products do expose ClassLoader properties that could potentially be exploited.

The following products expose ClassLoader properties that could be used by an attacker to read or execute files on the server that are outside the context path of the vulnerable Struts 2 application:

  • JBoss EAP 4.3 CP10
  • JWS 1.0.2 - Tomcat 6.0
  • JWS 2.0.1 - Tomcat 6.0 and Tomcat 7.0
  • RHEL 6 - Tomcat 6.0

Note: when running on Windows, attackers could use these flaws to achieve remote code execution on the products listed above, if they were able to control the content of a CIFS share that is accessible to the server.

The following products expose ClassLoader properties that could be used by an attacker, but for currently unknown reasons, they do not appear to be exploitable:

  • JWS 1.0.2 - Tomcat 5.5
  • RHEL 5 - Tomcat 5.5

The following products do not expose ClassLoader properties that are vulnerable to any currently known attack:

  • JBoss EAP 6.2.2
  • JBoss EAP 5.2.0

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.