Security Advisory - Apache Struts2 Remote Code Execution Vulnerability in Huawei Products
- SA No:huawei-sa-20160527-01-struts2
- Initial Release Date: May 27, 2016
- Last Release Date: Jul 01, 2020
Apache Struts2 released a remote code execution vulnerability in S2-032 on the official website,when Dynamic Method Invocation (DMI) is enabled, an exploit could allow the attacker to cause remote code execution.(Vulnerability ID: HWPSIRT-2016-04052)
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-3081.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
|
Product Name |
Affected Version |
Resolved Product and Version |
|
Agile Controller-Campus |
V100R002C00 |
V100R002C00SPC107 |
|
AnyOffice |
V200R005C00 |
Upgrade to AnyOffice EMM V200R006C00SPC101 |
|
V200R006C00 |
AnyOffice EMM V200R006C00SPC101 |
|
|
FireHunter6000 |
V100R001C20 |
V100R001C20SPC106T |
|
LogCenter |
V100R001C10 |
Upgrade to V100R001C20SPC102 |
|
V100R001C20 |
V100R001C20SPC102 |
|
|
OceanStor 5300 V3/5500 V3/5600 V3/5800 V3/6800 V3/18500 V3/18500F V3/18800 V3/18800F V3 |
V300R001 |
V300R003C10SPC100[1] |
|
V300R002 |
||
|
V300R003C00 |
||
| V300R003C10 |
||
|
OceanStor 9000 |
V100R001C01 |
Upgrade to V300R005C00SPH102 |
|
V100R001C30 |
||
|
V300R005C00 |
V300R005C00SPH102 |
|
|
OceanStor N8500 |
V200R001C09SPC505 |
V200R001C09SPC506 |
|
V200R001C91SPC205 |
Upgrade to V200R001C91SPC902 |
|
|
V200R001C91SPC900 |
V200R001C91SPC902 |
|
|
V200R001C91SPC901 |
V200R001C91SPC902 |
|
|
OceanStor Onebox |
V100R003C10 |
Upgrade to V100R005C00 |
[1]Only SystemReporter is affected, to fix the vulnerability, upgrade only the OceanStor xxx_DeviceManager_SystemReporter.zip in OceanStor V3.
By exploiting this vulnerability, an attacker can execute remote code.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Temporal Score: 7.7 (E:F/RL:O/RC:C)
1. Prerequisite:
DMI in Apache Struts2 server is enabled.
2. Attacking procedure:
Attackers can pass a malicious expression to the Apache Struts2 server to cause remote code execution.
For additional details, customers are advised to reference the Apache Struts2 official website:
Scenario 1: DMI is enabled on the Apache Struts2 server by default in the following products: OceanStor 5300 V3, OceanStor 5500 V3, OceanStor 5600 V3, OceanStor 5800 V3, OceanStor 6800 V3, OceanStor 9000.
Workarounds: Customers can contact Huawei Technical Assistance Center (TAC) to disable DMI on the Apache Struts2 server as follows:
1. Log in to the device and find the struts.xml file.
2. Set the value of struts.enable.DynamicMethodInvocation in the struts.xml file to false.
3. Restart the web server to make the modification in struts.xml file take effect.
Scenario 2: DMI is disabled on the Apache Struts2 server by default in the following products: FireHunter6000, OceanStor N8500, OceanStor Onebox.
Workarounds: Customers should contact Huawei Technical Assistance Center (TAC) to check the status of DMI, if DMI is enabled, please disable DMI on the Apache Struts2 server as following steps:
1. Login the device and find the struts.xml file.
2. Check the value of struts.enable.DynamicMethodInvocation in the struts.xml file. If the value is true, set it to false. If the value is false or empty, no operation is required.
3. Restart the web server to make the modification in struts.xml file take effect.
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities.
This vulnerability was disclosed in S2-032 on the Apache Struts2 official website.
None
Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.
To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.
To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.
