Top 10 winner

Apache Struts ClassLoader Manipulation Remote Code Execution

Lukasz Lenart · cwiki.apache.org

The Struts S2-020 bulletin covers two issues fixed in 2.3.16.1: Commons FileUpload 1.3 allows denial of service, and ParametersInterceptor accepts a class parameter mapped to getClass(), letting a remote attacker manipulate the ClassLoader. The advised remedies are upgrading the library and excluding class from request parameters.

Record

Researcher

Lukasz Lenart

Published by

cwiki.apache.org

In the archive

• Ranked #8 in the 2014 Top 10 Web Hacking Techniques

Related sources

• Blog Post
• Exploit implementation

Tags

• class-pollution
• rce
• dos
• mass-assignment
• struts
• java
• cve
• vendor-advisory
• mitigation
• owasp-a01-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Lukasz Lenart, first published at the original source. Preserved copies are kept so the citation survives its host.