Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Multiple Vulnerabilities (S2-075) (S2-078)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364469);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-104711", "CVE-2026-104714");
  script_xref(name:"IAVA", value:"2026-A-1088");

  script_name(english:"Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Multiple Vulnerabilities (S2-075) (S2-078)");

  script_set_attribute(attribute:"synopsis", value:
"The Apache Struts install on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x
prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by multiple vulnerabilities, as referenced in the
S2-075 and S2-078 advisories:

  - Improper neutralization of special elements used in an expression language statement ('Expression Language
    Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action
    mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is
    affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default
    action mapper, the restful2 mapper, or the Struts REST plugin are not affected. (CVE-2026-104711)

  - Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in
    Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that
    message by the application-wide text provider is used by concurrently served requests without isolation, so a
    value belonging to one user can appear in another user's response, or the rendering can fail and surface as a
    server error. Applications whose localized messages format no date or time arguments are not affected.
    (CVE-2026-104714)

Both issues are only exposed by specific application configurations, which Nessus cannot verify, so this finding is
flagged as a potential vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/446070946/S2-075");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/451972217/S2-078");
  script_set_attribute(attribute:"see_also", value:"https://struts.apache.org/announce-2026");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Struts version 6.12.0 / 7.4.0 or later. Alternatively, apply the workaround as referenced in the
vendor's security bulletin.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-104711");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:struts");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("struts_detect_win.nbin", "struts_detect_nix.nbin");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("installed_sw/Apache Struts");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache Struts', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2.0.0', 'max_version': '2.3.37', 'fixed_display': '6.12.0 / 7.4.0'},
        {'min_version': '2.5.0', 'max_version': '2.5.33', 'fixed_display': '6.12.0 / 7.4.0'},
        {'min_version': '6.0.0', 'fixed_version': '6.12.0'},
        {'min_version': '7.0.0', 'fixed_version': '7.4.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);