Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338651);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-73633", "CVE-2026-73635");
  script_xref(name:"IAVA", value:"2026-A-0858");

  script_name(english:"Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)");

  script_set_attribute(attribute:"synopsis", value:
"The Apache Struts install on the remote host is affected by multiple denial of service vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It
is, therefore, affected by multiple denial of service vulnerabilities, as referenced in the S2-072 and S2-074
advisories:

  - When an application is configured to populate actions from a JSON request body, the plugin reads that body
    into memory without bounding how much it will accept. A single request can therefore cause the server to
    allocate memory in proportion to the size of the request, exhausting the heap and denying service to other
    users. The plugin's configurable limit on JSON input length does not bound this read, so lowering that
    limit does not reduce exposure. This issue is confined to the JSON plugin, which is an optional component
    and not part of the Struts core. Applications that do not use the JSON plugin are not affected, and
    neither are applications that use it without enabling JSON request-body handling, which is not enabled by
    default. (CVE-2026-73633)

  - Struts resolves type-conversion and validation error messages through localized-text lookups. When no
    fixed locale is configured, the lookup locale is taken from the inbound request, so an unauthenticated
    remote client can drive the framework's internal localized-text caches to grow without bound and exhaust
    heap memory. Applications that configure a fixed locale are not affected. (CVE-2026-73635)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/444334429/S2-072");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/444334689/S2-074");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Struts version 6.11.0 / 7.3.0 or later. Alternatively, apply the workaround as referenced in the
vendor's security bulletin.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73633");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-73635");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:struts");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "struts_detect_win.nbin", "struts_detect_nix.nbin");
  script_require_keys("Host/OS", "installed_sw/Apache Struts", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');

# Not checking if JSON request-body handling is enabled, nor if a fixed locale is configured
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var os = get_kb_item_or_exit('Host/OS');
var win_local = ('windows' >< tolower(os));

var app_info = vcf::get_app_info(app:'Apache Struts', win_local:win_local);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '6.0.0', 'fixed_version' : '6.11.0' },
  { 'min_version' : '7.0.0', 'fixed_version' : '7.3.0' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);