CVE-2014-0114: Input Validation
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Other sources
It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions.
The root cause of this issue is the fact that commons-beanutils exposes the class property by default, with no mechanism to disable access to it. If a framework built on commons-beanutils does not otherwise suppress access to the class property, then a remote attacker could use this flaw to manipulate the ClassLoader used by the underlying container. This could lead to remote code execution under certain conditions. commons-beanutils 1.9.2 has now shipped, including a specialized BeanIntrospector implementation that allows suppressing properties. Frameworks built on commons-beantutils can make use of the new pre-configured SuppressPropertiesBeanIntrospector to address this flaw.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/strutsto a version that resolves this vulnerability.Fixed in 0:1.2.9-4jpp.8.el5_10 - Upgrade
Upgrade
redhat/strutsto a version that resolves this vulnerability.Fixed in 0:1.3.10-6.ep5.el6 - Upgrade
Upgrade
maven/commons-beanutils:commons-beanutilsto a version that resolves this vulnerability.Fixed in 1.9.4 - Upgrade
Upgrade
debian/commons-beanutilsto a version that resolves this vulnerability.Fixed in 1.9.4-1Fixed in 1.9.4-1+deb11u1Fixed in 1.9.4-1+deb12u1Fixed in 1.10.1-1.1 - Upgrade
Upgrade
Apache Commons BeanUtilsto a version that resolves this vulnerability.Fixed in 1.9.2 - Configuration
Configure the framework built on commons-beanutils to use the pre-configured SuppressPropertiesBeanIntrospector to suppress access to the 'class' property.
Frameworks built on commons-beanutils (BeanIntrospector) SuppressPropertiesBeanIntrospector = pre-configured
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-0114?
CVE-2014-0114 is classified as a moderate severity vulnerability.
How do I fix CVE-2014-0114?
To mitigate CVE-2014-0114, update Apache Commons BeanUtils to version 1.9.4 or later.
What software is affected by CVE-2014-0114?
CVE-2014-0114 affects Apache Struts versions up to 1.3.10 and Apache Commons BeanUtils versions up to 1.9.1.
Can CVE-2014-0114 lead to remote code execution?
Yes, CVE-2014-0114 allows remote attackers to manipulate the ClassLoader, which can lead to remote code execution.
Is there a patch available for CVE-2014-0114?
Yes, patches are available in updated versions of Apache Commons BeanUtils and Apache Struts.