Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Overview

Missing XML validation in Apache Struts' XWork component leads to an XML External Entity (XXE) vulnerability. The XWork component fails to validate XML properly, allowing external entities to be processed. This affects Struts versions 2.0.0 through 2.2.1 (exclusive) and 2.2.1 through 6.1.0 [1][3][4].

Exploitation

An attacker can exploit this by providing a crafted XML configuration file containing external entity references. The vulnerability is triggered when Struts parses XML configuration files. No authentication is required if an attacker can supply such input to the application. The attack surface includes any Struts application that processes XML configuration, potentially leading to exposure of internal files, denial of service, or server-side request forgery [4].

Impact

Successful exploitation allows an attacker to read arbitrary files from the server (data disclosure), cause a denial of service via resource exhaustion, or perform server-side request forgery, potentially to internal systems [4].

Mitigation

Users should upgrade to Struts 6.1.1, which fixes the vulnerability. For those unable to upgrade, workarounds include setting a custom SAXParserFactory via the xwork.saxParserFactory property, or configuring JVM-level properties to disable external entity processing: -Djavax.xml.accessExternalDTD="", -Djavax.xml.accessExternalSchema="", and -Djavax.xml.accessExternalStylesheet="" [4].