[GHSA-43mq-6xmg-29vm] Apache Struts file upload logic is flawed

[chximn-dt]

Updates

• Description
• Affected products
• References
• CWEs

Comments

• The vulnerable class was marked as deprecated in version 6.4.0 but was only removed in version 7.0.0. Therefore, applications using versions >=6.4.0, < 7.0.0 are still vulnerable

[advisory-database]

Hi @chximn-dt! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[chximn-dt]

Hi,

I noticed that the PR has been merged and the advisory's modified date has been updated in a47e619.
However, it seems that the changes proposed in the PR have not been applied.

Any insights into what might have happened?

[chximn-dt]

Hi @shelbyc, do you have any insights into this?

[shelbyc]

Hi @chximn-dt, thank you for pinging me! The PR was merged erroneously before I had a chance to review the changes.

I agree with your suggestion to add apache/struts@1ecfbae, apache/struts@3ef9ade, and https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677/ to the references, as well as the decision to add CWE-915. Those changes have been incorporated into the advisory, and your credit is still in the advisory.

With respect to changing the patched version from 6.4.0 to 7.0.0, I don't think I agree with the idea that the issue is only fully mitigated with the complete removal of FileUploadInterceptor in 7.0.0. If a project that depends on Struts has gone through the effort of replacing FileUploadInterceptor with ActionFileUploadInterceptor, that should be enough to mitigate the problem. Is it worth issuing more alerts to users who may not need them?

[chximn-dt]

Hi @shelbyc, thanks for the prompt reply.

I agree with the idea that the issue is not only fully mitigated by the complete removal of FileUploadInterceptor in version 7.0.0. If projects using versions 6.4.0 to before 7.0.0 have replaced FileUploadInterceptor with ActionFileUploadInterceptor, the problem should be sufficiently mitigated.

However, projects using these versions that haven't been updated to use ActionFileUploadInterceptor won't receive any alerts, potentially leading to a false sense of security (false negatives).

A version should be considered as vulnerable even if there is a workaround available.