Struts2 + Classloader Vulnerability + How to reproduce

Question

How to reproduce the security issue CVE-2014-0094. I googled but couldn't able to find any reference to the same.

Answer 1

Got it working.

I have to enable logging (for ognl package) to see the error.

Pass in parameter like class.classLoader.resource.dircontext.docBase=someText to the struts2 application.

localhost:8080/sampleApp/showlogin.do?class.classLoader.resource.diretext.docBase=someText

Then in the log I would see something like this.

java.lang.IllegalArgumentException: Document base base does not exist or is not a readable directory
    at org.apache.naming.resources.FileDirContext.setDocBase(FileDirContext.java:136)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

After applying the workaround then I don't see above error in the log.

Reference: http://www.brentron.com/safe/web/9248.html http://isayan.cocolog-nifty.com/diary/2014/04/s2-020.html

Answer 2

To get a better help, I suggest you to follow the guidelines in the official Struts2 Security Bulletins.

1. The bug you are refering to has been reported in S2-020, and has both a workaround without upgrading, and a patch in Struts 2.3.16.1.

2. WARNING: the above patch is not enough, as reported in S2-021, so there are both a new workaround (for users that can't immediately upgrade) and a definitive patch in Struts 2.3.16.2.

Answer 3

To reproduce the issue just send

http://host/struts2-blank/example/X.action?class.classLoader

The issue is documented under S2-020.