Description
A Remote Code Execution vulnerability exists in Apache Struts2 Showcase app in the Struts 1 plugin example in the Struts 2.3.x series.
Remediation
Always use resource keys instead of passing a raw message to the ActionMessage as shown below, never pass a raw value directly messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName())); and never like this messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));
References
Related Vulnerabilities
Ruby on Rails CVE-2015-3227 Vulnerability (CVE-2015-3227)
MySQL CVE-2020-14878 Vulnerability (CVE-2020-14878)
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2011-4298)
Oracle Database Server CVE-2023-22075 Vulnerability (CVE-2023-22075)
MediaWiki Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2021-36125)