CWE-106: Struts: Plug-in Framework not in Use

How it's found

Struts: Plug-in Framework not in Use is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

Vulnerable vs. safe

// private variables for registration form

// getter and setter methods for private variablessuper();private String name;private String email;...public RegistrationForm() {}...public class RegistrationForm extends org.apache.struts.action.ActionForm {}

// private variables for registration form

// getter and setter methods for private variablessuper();private String name;private String email;...public RegistrationForm() {}public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}...public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {}

Consequences

• Unexpected State

Mitigations

• Architecture and Design: Use an input validation framework such as Struts.
• Architecture and Design: Use an input validation framework such as Struts.
• Implementation: Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that:Phone number fields contain only valid characters in phone numbers Boolean values are only "T" or "F" Free-form strings are of a reasonable length and composition
• Implementation: Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that:Phone number fields contain only valid characters in phone numbers Boolean values are only "T" or "F" Free-form strings are of a reasonable length and composition

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Base weakness
  CWE-1173: Improper Use of Validation Framework
• Class weakness
  CWE-20: Improper Input Validation