Rule Definition
Critical remote code execution vulnerabilities like the one that affected Equifax and the one we announced today are incredibly dangerous for several reasons: Struts is used for publicly-accessible customer-facing websites, vulnerable systems are easily identified, and the flaw is easy to exploit. A hacker can find their way in within minutes, and exfiltrate data or stage further attacks from the compromised system. It’s crucially important to update affected systems immediately; to wait is to take an irresponsible risk.

Remediation
This new remote code execution vulnerability affects all supported versions of Apache Struts 2. - Users of Struts 2.3 are strongly advised to upgrade to 2.3.35 - Users of Struts 2.5 need to upgrade to 2.5.17.

Violation Code Sample

For example, the following struts.xml configuration is potentially vulnerable becasue no namespace is specified 

<struts>
  <package> //no namespace is specified
    <action name="a1">
      <result type="redirectAction">
        <param name="actionName">a2.action</param>
      </result>
    </action>
  </package>
</struts>

<struts>
  <constant name="struts.mapper.alwaysSelectFullNamespace" value="true" /> //alwaysSelectFullNamespace set to True
  ...

--------------------

For example, the following struts.xml configuration is potentially vulnerable because a wildcard namespace is used
<struts>
  <package name="mypackage1" namespace="/*"> // wildcard namespace
    <action name="a1">
      <result type="redirectAction">
        <param name="actionName">a2.action</param>
      </result>
    </action>
  </package>
</struts>

<struts>
  <constant name="struts.mapper.alwaysSelectFullNamespace" value="true" /> //alwaysSelectFullNamespace set to True
  ...

Fixed Code Sample

This new remote code execution vulnerability affects all supported versions of Apache Struts 2. 
- Users of Struts 2.3 are strongly advised to upgrade to 2.3.35
- Users of Struts 2.5 need to upgrade to 2.5.17.

https://cwiki.apache.org/confluence/display/WW/S2-057 https://nvd.nist.gov/vuln/detail/CVE-2018-11776