Skip to content
This repository was archived by the owner on May 6, 2025. It is now read-only.

CVE-2014-0114 Fix #1

Open
wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

CVE-2014-0114 Fix #1

wants to merge 1 commit into from
+10 −2

Conversation

abn
Copy link

@abn abn commented Apr 30, 2014

@abn
CVE-2014-0114 Fix
09f9270 
- Ignore any property that attempts to use the class attribute
- Based on https://gist.github.com/ykare/1fb2d5d11e16cb0003c3#file-2-beanutils-patch-struts1-0-2
@jo-nav
Copy link

jo-nav commented Sep 26, 2014

A different fix is at http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Protect-your-Struts1-applications/ba-p/6463188#.VCUfrhYvBaV. It uses a servlet filter to apply a regex similar to your one but it checks both for the word "class" and "Class". I think you should update your code to include "Class".

@abn
Copy link
Author

abn commented Sep 27, 2014

@jo-nav the pattern is compiled with Pattern.CASE_INSENSITIVE. This should handle both Class and class..

@jo-nav
Copy link

jo-nav commented Sep 29, 2014

Ah, ok, I examined only the regex string...

@rajeshmanoharann rajeshmanoharann mentioned this pull request May 2, 2016
Open
@smasam
Copy link

smasam commented Sep 28, 2017

how can I test remote code execution?

@veenarm veenarm mentioned this pull request Sep 27, 2018
Merged
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@abn @jo-nav @smasam