XWork 1.2.3 Released
The OpenSymphony XWork team is proud to announce the release of XWork 1.2.3, the latest release in the 1.2 branch of XWork, a command pattern framework, which forms the core of the WebWork 2 framework.
This release specifically addresses a critical security issue allowing users to execute arbituary any OGNL expression.
We encourage all users of XWork 1.2.x and WebWork 2.2.x to update to this release.
Summary
Remote code exploit on form validation error
Who should read this |
All XWork 1.2.x, XWork 2.x, WebWork 2.2.x, Struts 2 developers |
Impact of vulnerability |
Remote code execution |
Maximum security rating |
Critical |
Recommendation |
Developers should either apply the patch or upgrade XWork immediately |
Affected Software |
WebWork 2.1 (with altSyntax enabled), WebWork 2.2.0 - WebWork 2.2.5, Struts 2.0.0 - Struts 2.0.8 |
Non-Affected Software |
WebWork 2.0, WebWork 2.1 (with altSyntax disabled, which is the default) |
Original JIRA Ticket |
WW-2030 |
Problem
The 'altSyntax' feature of WebWork 2.1+ and Struts 2 allows OGNL expressions to be inserted into text strings and is processed recursively. This allows a malicious user to submit a string, usually through an HTML text field, containing an OGNL expression that will then be executed by the server if the form validation has failed. For example, say we had this form that required the 'phoneNumber' field to not be blank:
<s:form action="editUser">
<s:textfield name="name" />
<s:textfield name="phoneNumber" />
</s:form>
The user could leave the 'phoneNumber' field blank to trigger the validation error, then populate the 'name' field with %{1+1}. When the form is re-displayed to the user, the value of the 'name' field will be '2'. The reason is the value field is, by default, processed as %{name}, and since OGNL expressions are evaluated recursively, it is evaluated as if the expression was %{%{1+1}}.
The OGNL parsing code is actually in XWork and not in WebWork 2 or Struts 2.
Solution
The fixed version of XWork changes the OGNL parsing so that it is not recursive. Therefore, in the example above, the result will be the expected %{1+1}. You can either obtain the latest version of WebWork 2 or Struts 2, which contains the fixed XWork library, or download the fixed XWork library directly. Alternatively, you can obtain the patch and apply it to the XWork source code yourself.
For users of the WebWork 2.2 series, please upgrade to version 2.2.6 available from the download page as drop in replacement.
For a complete list of all the changes, please refer to the
complete changelog
OpenSymphony JIRA
(8 issues)
|
T |
Key |
Summary |
Assignee |
Reporter |
Pr |
Status |
Res |
Created |
Updated |
Due |
|
XW-544
|
User input is evaluated as an OGNL expression
|
Rainer Hermanns
|
Rainer Hermanns
|
|
Closed
|
FIXED
|
Jul 18, 2007
|
Jul 19, 2007
|
|
|
XW-535
|
external-ref tag's content cannot be read occasionally by some parser
|
tm_jee
|
tm_jee
|
|
Resolved
|
FIXED
|
Jul 01, 2007
|
Jul 02, 2007
|
|
|
XW-524
|
ParameterInterceptor log parameter value twice for the first parameter when there's more than one parameter of the same name.
|
tm_jee
|
tm_jee
|
|
Resolved
|
FIXED
|
May 30, 2007
|
Jul 17, 2007
|
|
|
XW-523
|
eliminate the use of static block to call ConfigurationManager's destroyConfiguration() method
|
tm_jee
|
tm_jee
|
|
Resolved
|
FIXED
|
May 28, 2007
|
Jun 02, 2007
|
|
|
XW-522
|
Interceptor destroy() method is never called.
|
tm_jee
|
tm_jee
|
|
Resolved
|
FIXED
|
May 27, 2007
|
Jun 02, 2007
|
|
|
XW-507
|
XWorkBasicConvert - RFC3339 not thread safe
|
Claus Ibsen
|
Claus Ibsen
|
|
Resolved
|
FIXED
|
Apr 13, 2007
|
Apr 13, 2007
|
|
|
XW-501
|
VisitorFieldValidator loses original TextProvider
|
tm_jee
|
Vlad Kravchenko
|
|
Resolved
|
FIXED
|
Mar 28, 2007
|
Jul 21, 2007
|
|
|
XW-443
|
Validator parameters and message handled improperly
|
Don Brown
|
Michal Karwanski
|
|
Resolved
|
FIXED
|
Nov 28, 2006
|
Jul 18, 2007
|
|
About WebWork
WebWork is a leading open source Java web application framework. Developed originally by Rickard Oberg (original developer of JBoss and creator of XDoclet, among other accomplishments), WebWork aims to lower the bar for developing web applications by making the more tedious tasks of web development automated. By taking the best features from other web frameworks available today, WebWork represents a best-of-bread solution to web development created by through the feedback of an active OpenSymphony community.
WebWork is built on top of XWork, a generic command pattern framework. WebWork uses the capabilities of XWork to provide the following features:
- Advanced UI components, allowing you to build complex, reusable UI components, ranging from simple text fields to advanced date pickers.
- A robust inversion of control (IoC) container that binds to the native Servlet lifecycles: request, session, and application.
- Pluggable configuration, allowing you to develop web "modules" that can easily be integrated together to form complete applications independently.
- Complete data mapping from HTTP to Java data objects, enabling you to focus more on application development and less on tedious data conversion.
- A complete validation framework, both on the server side and client side. This lets you choose the most optimal way to ensure user input is correct before processing it.
- An advanced expression language, based on OGNL, providing the most common operations usually associated with building web-based user interfaces.
- Support for integration with many popular open source projects, including: Spring, Pico, OSWorkflow, FreeMarker, Velocity, JasperReports, JFreeChart, and many more.
|