Apache Struts up to 2.3.4 Token Name Configuration Parameter cross-site request forgery
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.2 | $0-$5k | 0.00 |
A vulnerability has been found in Apache Struts (Programming Tool Software) and classified as critical. This vulnerability affects an unknown functionality of the component Token Name Configuration Parameter Handler. The manipulation of the argument Configuration
with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect confidentiality, and integrity. CVE summarizes:
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
The weakness was published 08/03/2012 by James K. Williams as S2-010 as confirmed advisory (Website). The advisory is available at struts.apache.org. This vulnerability was named CVE-2012-4386 since 08/21/2012. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a private exploit are known.
It is declared as highly functional.
Upgrading to version 2.3.4.1 eliminates this vulnerability. The upgrade is hosted for download at struts.apache.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. As of Struts 2.3.4.1, token session attribute names are decoupled from token parameter names by namespace prefixing.
The vulnerability is also documented in the vulnerability database at X-Force (78182). Additional details are provided at issues.apache.org. Similar entries are available at 6069 and 62035.
Product
Type
Vendor
Name
Version
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.0.8
- 2.0.9
- 2.0.10
- 2.0.11
- 2.0.11.1
- 2.0.11.2
- 2.0.12
- 2.0.13
- 2.0.14
- 2.1.0
- 2.1.1
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.8
- 2.1.8.1
- 2.2.1
- 2.2.1.1
- 2.2.3
- 2.2.3.1
- 2.3.1.1
- 2.3.1.2
- 2.3.3
- 2.3.4
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.2
VulDB Base Score: 6.5
VulDB Temp Score: 6.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Cross-site request forgeryCWE: CWE-352 / CWE-862 / CWE-863
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Access: Private
Status: Highly functional
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: Struts 2.3.4.1
Timeline
07/09/2012 🔍08/03/2012 🔍
08/03/2012 🔍
08/21/2012 🔍
08/31/2012 🔍
08/31/2012 🔍
08/31/2012 🔍
09/02/2012 🔍
09/05/2012 🔍
03/19/2015 🔍
08/26/2017 🔍
Sources
Vendor: apache.orgAdvisory: S2-010
Researcher: James K. Williams
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2012-4386 (🔍)
X-Force: 78182 - Apache Struts cross-site request forgery, Medium Risk
Vulnerability Center: 49135 - Apache Struts 2.0.0 through 2.3.4 CSRF Vulnerability due to Improper Token Validation, Medium
SecurityFocus: 55346 - Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
Secunia: 50420 - Apache Struts Cross-Site Request Forgery and Denial of Service Vulnerabilities, Moderately Critical
OSVDB: 85010
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
See also: 🔍
Entry
Created: 09/02/2012 13:26Updated: 08/26/2017 06:38
Changes: 09/02/2012 13:26 (74), 08/26/2017 06:38 (9)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.