CVE-2014-0114

Name of the Vulnerable Software and Affected Versions Apache Commons BeanUtils versions 1.8.0 through 1.9.2 Apache Struts versions 1.x through 1.3.10

Description The issue allows remote attackers to manipulate the ClassLoader and execute arbitrary code via the class parameter. This can be demonstrated by passing the class parameter to the getClass method of the ActionForm object in Struts 1. The vulnerability exists due to the possibility of accessing class properties in Apache Commons BeanUtils.

Recommendations For Apache Commons BeanUtils versions 1.8.0 through 1.9.2, consider disabling access to the class property to prevent ClassLoader manipulation until a patch is available. For Apache Struts versions 1.x through 1.3.10, restrict access to the getClass method of the ActionForm object to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.