Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2014-0114 Fix #1

Open
wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

CVE-2014-0114 Fix #1

wants to merge 1 commit into from

Conversation

abn
Copy link

@abn abn commented Apr 30, 2014

@abn
CVE-2014-0114 Fix
09f9270 
- Ignore any property that attempts to use the class attribute
- Based on https://gist.github.com/ykare/1fb2d5d11e16cb0003c3#file-2-beanutils-patch-struts1-0-2
@jo-nav
Copy link

jo-nav commented Sep 26, 2014

A different fix is at http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Protect-your-Struts1-applications/ba-p/6463188#.VCUfrhYvBaV. It uses a servlet filter to apply a regex similar to your one but it checks both for the word "class" and "Class". I think you should update your code to include "Class".

@abn
Copy link
Author

abn commented Sep 27, 2014

@jo-nav the pattern is compiled with Pattern.CASE_INSENSITIVE. This should handle both Class and class..

@jo-nav
Copy link

jo-nav commented Sep 29, 2014

Ah, ok, I examined only the regex string...

@rajeshmanoharann rajeshmanoharann mentioned this pull request May 2, 2016
Open
@smasam
Copy link

smasam commented Sep 28, 2017

how can I test remote code execution?

@veenarm veenarm mentioned this pull request Sep 27, 2018
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@abn @jo-nav @smasam