[GHSA-qw4h-3xjj-84cc] Apache Tiles: Unvalidated input may lead to path traversal and XXE

[ryanmurf]

Updates

• Affected products

Comments
Tiles is included in Struts 1.
Struts 1 the groupId was struts from 1.1 to 1.2.9 then was changed to org.apache.struts in >=1.3 to the last release 1.3.10. Tiles was included in struts:stuts 1.1-1.2.9 and in struts 1 >=1.3 was moved to org.apache.struts:struts-tiles

[Copilot]

Pull Request Overview

This PR adds a GitHub Security Advisory (GHSA) for Apache Tiles vulnerability CVE-2023-49735, which addresses unvalidated input leading to path traversal and XXE attacks. The advisory documents affected products including Apache Tiles and Struts components that include Tiles functionality.

• Adds comprehensive vulnerability advisory with CVSS scoring and affected package ranges
• Documents three affected Maven packages: tiles-core, struts-tiles, and the legacy struts package
• Includes proper references to NVD, GitHub repository, and Apache mailing list

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[helixplant]

Hi @ryanmurf,
GHSA-qw4h-3xjj-84cc affects the Apache Tiles package versions 2 and higher. The packages being added do not reach the vulnerable version range specified in the advisory:

• org.apache.struts:struts-tiles ranges from 1.3.5 - 1.3.10
• struts:struts ranges from 1.0.2 - 1.2.9

[ryanmurf]

Hi @ryanmurf, GHSA-qw4h-3xjj-84cc affects the Apache Tiles package versions 2 and higher. The packages being added do not reach the vulnerable version range specified in the advisory:

• org.apache.struts:struts-tiles ranges from 1.3.5 - 1.3.10
• struts:struts ranges from 1.0.2 - 1.2.9

@helixplant I think I need to give a little more context for this one.

Apache-Tiles originally Struts-Tiles see here was split from the struts source code at at version 2.

The first release of Apache-Tiles started at version 2 see here

Here is a link to tiles and tiles2 in the apache struts1 source code

• https://github.com/apache/struts1/tree/trunk/tiles
• https://github.com/apache/struts1/tree/trunk/tiles2

Here is a link talking about the file name changes in Apache-Tiles vs Struts-Tiles

• https://github.com/apache/tiles/blob/2601bcd2d8c7c5f1dde663830093c426ffff3da4/src/site/apt/migration/extension.apt#L75

The file I marked in the link above is here in struts1

• https://github.com/apache/struts1/blob/trunk/tiles/src/main/java/org/apache/struts/tiles/xmlDefinition/I18nFactorySet.java

That file is important because the in Struts-Tiles that is where the vulnerability is.

[helixplant]

Hi @ryanmurf,
Thank you so much for the follow up and the extra information! I will go over this and have an answer for you on #6318.

[ryanmurf]

Hi @ryanmurf, Thank you so much for the follow up and the extra information! I will go over this and have an answer for you on #6318.

Thank you!