CVE-2015-2992

Vulnerability

Overview

CVE-2015-2992 is a cross-site scripting (XSS) vulnerability in Apache Struts versions prior to 2.3.20. The root cause is that the framework does not prevent direct access to JSP files, which can be requested without going through a Struts action. This allows an attacker to inject malicious scripts into the response if the JSP file contains user-controlled input or is not properly sanitized [2].

Exploitation

An attacker can exploit this vulnerability by crafting a URL that directly accesses a JSP file on the server. No authentication is required, as the JSP file is served directly by the web container. The attack is successful when the user's browser processes the response without proper XSS filtering, leading to script execution in the user's session [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information. The impact is limited to scenarios where the XSS filter is disabled or bypassed, but it remains a significant risk for applications that expose JSP files directly [2].

Mitigation

The vulnerability is fixed in Apache Struts 2.3.20 and later. For applications that cannot upgrade immediately, the developer recommends placing all JSP files under the WEB-INF folder to prevent direct access, or adding a security constraint in web.xml to restrict direct JSP access [1]. These measures effectively eliminate the attack vector.