Security Bulletin: ClassLoader manipulation with Apache Struts affecting Rational Application Developer (CVE-2014-0114)

Summary

There is a ClassLoader manipulation vulnerability in Apache Struts that is
bundled by IBM Rational Application Developer for WebSphere Software.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support
alerts like this.

• Follow this link for more information (requires login with your IBM ID)

—|—

CVEID: [CVE-2014-0114](http://cve.mitre.org/cgi-
bin/cvename.cgi?name=CVE-2014-0114)

Description: Apache Struts 1.X could allow a remote attacker to execute
arbitrary code on the system, caused by the failure to restrict the setting of
Class Loader attributes. There is partial impact to confidentiality,
integrity, and availability.

CVSS Base Score: 7.5 CVSS Temporal Score: See
<https://exchange.xforce.ibmcloud.com/vulnerabilities/92889&gt; for the current
score
CVSS Environmental Score:* Undefined CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Rational Application Developer 7.0 to 9.1 are affected.

Remediation/Fixes

The issue can be addressed by installing a servlet filter to prevent passing
an attack payload to the action servlet of your struts applications.

1. Download CVE-2014-0114_patch.jar
2. Add a copy of the JAR file to the WEB-INF/lib/ folder of your Web module.
3. Modify your Web modules’ deployment descriptor to ensure parameters passed to the struts code is filtered:
   1. Open the Web module deployment descriptor (web.xml)
   2. Add a new filter
   1. Set the filter name to ParamFilter
   2. Set the filter class to com.ibm.rational.struts1x.patch.ParamFilter

3. Add a new Initialization Parameter to the filter created in step 2.
  1. Set the initialization parameter name to `excludeParams`
  2. Set the initialization parameter value to the following:  

``(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*

4. Add a new filter mapping
  1. Set the filter mapping name to `ParamFilter`
  2. Add a new Servlet Name to the filter mapping
    1. Set the name to be the name of the existing servlet for each Struts action.
5. Save the descriptor file

The end result will be the following:

<filter> <filter-name>ParamFilter</filter-name> <filter-class>com.ibm.rational.struts1x.patch.ParamFilter</filter-class> <init-param> <param-name>excludeParams</param-name> <param-value>(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*</param-value> </init-param> </filter> <filter-mapping> <filter-name>ParamFilter</filter-name> <servlet-name> ** _YOUR ACTION SERVLET_** </servlet-name> </filter-mapping>

Note: IBM does not plan on shipping any fix for Struts 1.x as the fix is
only available at the current levels of Apache Struts which can only be
obtained from the Apache Struts website.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important
product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Off

Related Information

[IBM Secure Engineering Web Portal](http://www.ibm.com/security/secure-
engineering/bulletins.html)
IBM Product Security Incident Response Blog

Security Bulletin: ClassLoader manipulation with Apache Struts in WebSphere
Application Server affecting Rational Application Developer
(CVE-2014-0114)

Change History

• 28 May 2014: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an “industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response.” IBM PROVIDES THE CVSS SCORES ““AS IS”” WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Internal Use Only

PSIRT Adv 1719, Record 36020

[{“Product”:{“code”:“SSRTLW”,“label”:“Rational Application Developer for
WebSphere Software”},“Business Unit”:{“code”:“BU053”,“label”:“Cloud & Data
Platform”},“Component”:“Web
Development”,“Platform”:[{“code”:“PF016”,“label”:“Linux”},{“code”:“PF022”,“label”:“OS
X”},{“code”:“PF033”,“label”:“Windows”}],“Version”:“7.0;7.0.0.1;7.0.0.10;7.0.0.2;7.0.0.3;7.0.0.4;7.0.0.5;7.0.0.6;7.0.0.7;7.0.0.8;7.0.0.9;7.5;7.5.1;7.5.2;7.5.3;7.5.4;7.5.5;7.5.5.1;7.5.5.2;7.5.5.3;7.5.5.4;7.5.5.5;8.0;8.0.1;8.0.2;8.0.3;8.0.4;8.0.4.1;8.0.4.2;8.0.4.3;8.5;8.5.1;8.5.5;9.0;9.0.1;9.1”,“Edition”:“”,“Line
of
Business”:{“code”:“LOB45”,“label”:“Automation”}},{“Product”:{“code”:“SSJVRK”,“label”:“Rational
Application Developer Standard Edition for WebSphere Software”},“Business
Unit”:{“code”:“BU053”,“label”:“Cloud & Data Platform”},“Component”:"
“,“Platform”:[{“code”:“PF033”,“label”:“Windows”},{“code”:“PF016”,“label”:“Linux”}],“Version”:“8.0;8.0.1;8.0.2;8.0.3;8.0.4;8.0.4.1;8.0.4.2;8.0.4.3”,“Edition”:”",“Line
of Business”:{“code”:“LOB45”,“label”:“Automation”}}]