CVE-2014-0114
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Apache Commons BeanUtils, según se distribuye en lib/commons-beanutils-1.8.0.jar en Apache Struts 1.x hasta la versión 1.3.10 y en otros productos que requieren commons-beanutils hasta la versión 1.9.2, no suprime la propiedad class, lo que permite a atacantes remotos "manipular" el ClassLoader y ejecutar código arbitrario a través del parámetro class, según lo demostrado por el paso de este parámetro al método getClass del objeto ActionForm en Struts 1.
Apache Struts is a framework for building web applications with Java. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. All struts users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using struts must be restarted for this update to take effect.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-12-03 CVE Reserved
- 2014-03-06 First Exploit
- 2014-04-29 CVE Published
- 2024-08-06 CVE Updated
- 2025-04-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CAPEC
References (129)
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/149050 | 2018-08-23 | |
| https://www.exploit-db.com/exploits/41690 | 2014-03-06 | |
| https://github.com/rgielen/struts1filter | 2024-01-13 | |
| https://github.com/ricedu/struts1-patch | 2014-06-10 | |
| https://github.com/aenlr/strutt-cve-2014-0114 | 2024-06-26 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Commons Beanutils Search vendor "Apache" for product "Commons Beanutils" | <= 1.9.1 Search vendor "Apache" for product "Commons Beanutils" and version " <= 1.9.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.0 Search vendor "Apache" for product "Struts" and version "1.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.0.2 Search vendor "Apache" for product "Struts" and version "1.0.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | b1 |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | b2 |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | b3 |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | rc1 |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.1 Search vendor "Apache" for product "Struts" and version "1.1" | rc2 |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.2 Search vendor "Apache" for product "Struts" and version "1.2.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.4 Search vendor "Apache" for product "Struts" and version "1.2.4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.6 Search vendor "Apache" for product "Struts" and version "1.2.6" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.7 Search vendor "Apache" for product "Struts" and version "1.2.7" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.8 Search vendor "Apache" for product "Struts" and version "1.2.8" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.2.9 Search vendor "Apache" for product "Struts" and version "1.2.9" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.3.5 Search vendor "Apache" for product "Struts" and version "1.3.5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.3.8 Search vendor "Apache" for product "Struts" and version "1.3.8" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Struts Search vendor "Apache" for product "Struts" | 1.3.10 Search vendor "Apache" for product "Struts" and version "1.3.10" | - |
Affected
| ||||||