Vulnerability-Lookup

CNVD-2023-97016

Vulnerability from cnvd - Published: 2023-12-12

Title

Apache Struts目录遍历漏洞

Description

Apache Struts是美国阿帕奇（Apache）基金会的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts存在目录遍历漏洞，该漏洞是由于Struts框架上传⽂件的逻辑缺陷，攻击者可利用该漏洞通过构造⽂件上传参数，进⾏⽬录穿越，执行远程代码。

Severity

高

Patch Name

Apache Struts目录遍历漏洞的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://www.openwall.com/lists/oss-security/2023/12/07/1

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-50164

Impacted products

Name
['Apache struts >=2.0.0，<=2.5.32', 'Apache struts >=6.0.0，<=6.3.0.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-50164"
    }
  },
  "description": "Apache Struts\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u9879\u76ee\uff0c\u662f\u4e00\u5957\u7528\u4e8e\u521b\u5efa\u4f01\u4e1a\u7ea7Java Web\u5e94\u7528\u7684\u5f00\u6e90MVC\u6846\u67b6\uff0c\u4e3b\u8981\u63d0\u4f9b\u4e24\u4e2a\u7248\u672c\u6846\u67b6\u4ea7\u54c1\uff0cStruts 1\u548cStruts 2\u3002\n\nApache Struts\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eStruts\u6846\u67b6\u4e0a\u4f20\u2f42\u4ef6\u7684\u903b\u8f91\u7f3a\u9677\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u2f42\u4ef6\u4e0a\u4f20\u53c2\u6570\uff0c\u8fdb\u2f8f\u2f6c\u5f55\u7a7f\u8d8a\uff0c\u6267\u884c\u8fdc\u7a0b\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.openwall.com/lists/oss-security/2023/12/07/1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-97016",
  "openTime": "2023-12-12",
  "patchDescription": "Apache Struts\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5f00\u6e90\u9879\u76ee\uff0c\u662f\u4e00\u5957\u7528\u4e8e\u521b\u5efa\u4f01\u4e1a\u7ea7Java Web\u5e94\u7528\u7684\u5f00\u6e90MVC\u6846\u67b6\uff0c\u4e3b\u8981\u63d0\u4f9b\u4e24\u4e2a\u7248\u672c\u6846\u67b6\u4ea7\u54c1\uff0cStruts 1\u548cStruts 2\u3002\r\n\r\nApache Struts\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eStruts\u6846\u67b6\u4e0a\u4f20\u2f42\u4ef6\u7684\u903b\u8f91\u7f3a\u9677\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u2f42\u4ef6\u4e0a\u4f20\u53c2\u6570\uff0c\u8fdb\u2f8f\u2f6c\u5f55\u7a7f\u8d8a\uff0c\u6267\u884c\u8fdc\u7a0b\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Struts\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache struts \u003e=2.0.0\uff0c\u003c=2.5.32",
      "Apache struts \u003e=6.0.0\uff0c\u003c=6.3.0.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-50164",
  "serverity": "\u9ad8",
  "submitTime": "2023-12-12",
  "title": "Apache Struts\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2023-50164 (GCVE-0-2023-50164)

Vulnerability from cvelistv5 – Published: 2023-12-07 08:49 – Updated: 2025-03-14 03:55

Title

Apache Struts: File upload component had a directory traversal vulnerability

Summary

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Severity

No CVSS data available.

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-16 00:00 UTC

CWE

CWE-552 - Files or Directories Accessible to External Parties

Assigner

apache mitre root Scorecard

References

4 references

URL	Tags
https://lists.apache.org/thread/yh09b3fkf6vz5d6jd…	vendor-advisorymailing-list
https://www.openwall.com/lists/oss-security/2023/…
http://packetstormsecurity.com/files/176157/Strut…
https://security.netapp.com/advisory/ntap-2023121…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Struts	Affected: 2.0.0 , ≤ 2.5.32 (semver) Affected: 6.0.0 , ≤ 6.3.0.1 (semver)

Credits

Steven Seeley of Source Incite

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:09:49.645Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2023/12/07/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231214-0010/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-50164",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-14T03:55:16.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.struts",
          "product": "Apache Struts",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.5.32",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.0.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Steven Seeley of Source Incite"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\u003c/span\u003e\u003cbr\u003eUsers are recommended to upgrade to versions \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eStruts 2.5.33 or Struts 6.3.0.2 or greater to\u003c/span\u003e\u0026nbsp;fix this issue.\u003cbr\u003e"
            }
          ],
          "value": "An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.\nUsers are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to\u00a0fix this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "critical"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-14T10:06:29.117Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "mailing-list"
          ],
          "url": "https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2023/12/07/1"
        },
        {
          "url": "http://packetstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231214-0010/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Struts: File upload component had a directory traversal vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-50164",
    "datePublished": "2023-12-07T08:49:19.853Z",
    "dateReserved": "2023-12-04T08:37:57.468Z",
    "dateUpdated": "2025-03-14T03:55:16.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2023-97016

CVE-2023-50164 (GCVE-0-2023-50164)

Tags

Sightings

Nomenclature

Related by attack behaviour