Apache Struts 2.1.8 <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-077)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364468);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-104713");
  script_xref(name:"IAVA", value:"2026-A-1088");

  script_name(english:"Apache Struts 2.1.8 <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-077)");

  script_set_attribute(attribute:"synopsis", value:
"The Apache Struts install on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Struts installed on the remote host is 2.1.8 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x
prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced
in the S2-077 advisory:

  - Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request
    body is read into memory without any bound on how much will be accepted, so a single request can cause the
    server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other
    users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
    (CVE-2026-104713)

Nessus cannot verify whether the application uses the REST plugin, so this finding is flagged as a potential
vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/451972213/S2-077");
  script_set_attribute(attribute:"see_also", value:"https://struts.apache.org/announce-2026");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Struts version 6.12.0 / 7.4.0 or later. Alternatively, apply the workaround as referenced in the
vendor's security bulletin.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-104713");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:struts");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("struts_detect_win.nbin", "struts_detect_nix.nbin");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("installed_sw/Apache Struts");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache Struts', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2.1.8', 'max_version': '2.3.37', 'fixed_display': '6.12.0 / 7.4.0'},
        {'min_version': '2.5.0', 'max_version': '2.5.33', 'fixed_display': '6.12.0 / 7.4.0'},
        {'min_version': '6.0.0', 'fixed_version': '6.12.0'},
        {'min_version': '7.0.0', 'fixed_version': '7.4.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);