Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Cleber Souza (CleberS2) Dell Computadores DO Brasil Ltda
Dell Computadores DO Brasil Ltda
BR
CleberS2 Member since 2017 5 posts
Dell Computadores DO Brasil Ltda
Posted: Sep 8, 2017
Last activity: Oct 13, 2017
Posted: 8 Sep 2017 16:17 EDT
Last activity: 13 Oct 2017 9:22 EDT
Closed
Solved

PRPC SMA v7.1.7 Apache Struts Vulnerability

We are using PRPC System Management version 7.1.7 and there are some vulnerabilities known for Apache Struts in this current version:

The vulnerability is a programming blunder that resides in the way Struts processes data from an untrusted source. Specifically, Struts REST plugin fails to handle XML payloads while reserializing them properly. All versions of Apache Struts since 2008 (Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12) are affected, leaving all web applications using the framework’s REST plugin vulnerable to remote attackers.

Will update SMA to version 7.2.2 prevent us to have this issue, once Apache Struts version 2.5.13 already resolve this problem?

The resolution for this issue would be to update Apache Struts to version 2.5.13 or to remove Struts REST plugin. Can someone help me on this question?

To see attachments, please log in.
Security

Accepted Solution

Posted: 7 years ago
Posted: 11 Sep 2017 13:31 EDT
Brad Tainter (Br@dTainter_GCS) PEGA Fellow, Technical Support, Platform Service
Pegasystems Inc.
US

Hi SrivatsaS,

Pega is not vulnerable to any of these 4 issues:
CVE-2017-9804  / s2-050 : SMA does not use the default regex of the URLValidator class
CVE-2017-9793 / s2-051 : SMA does not use REST plugin
CVE-2017-9405 / s2-052 : SMA does not use REST plugin
CVE-2017-12611 / s2-053 : SMA does not use Freemarker
To see attachments, please log in.
Posted: 7 years ago
Posted: 11 Sep 2017 9:58 EDT
Srivatsa Srinath (SrivatsaS) Wells Fargo
Wells Fargo
IN

Hey thanks for this info. How about CVE-2017-9804 and CVE-2017-12611? These CVEs' do not have any mention of REST plugin. Is Pega exposed to vulnerabilities because of these CVEs'?

To see attachments, please log in.

Accepted Solution

Posted: 7 years ago
Posted: 11 Sep 2017 13:31 EDT
Brad Tainter (Br@dTainter_GCS) PEGA Fellow, Technical Support, Platform Service
Pegasystems Inc.
US

Hi SrivatsaS,

Pega is not vulnerable to any of these 4 issues:
CVE-2017-9804  / s2-050 : SMA does not use the default regex of the URLValidator class
CVE-2017-9793 / s2-051 : SMA does not use REST plugin
CVE-2017-9405 / s2-052 : SMA does not use REST plugin
CVE-2017-12611 / s2-053 : SMA does not use Freemarker
To see attachments, please log in.
Posted: 7 years ago
Posted: 28 Sep 2017 10:33 EDT
Rodney Jackson (RodneyJ5) Citizens Bank
Citizens Bank
US

Has there been any analysis into any of the earlier vulnerabilities particularly the other remote code execution findings?  The following CVEs are not the version that are in the news currently, but have fairly high CVSS ratings that can lead to remote code execution.  http://www.cvedetails.com/cve/CVE-2014-0114/ http://www.cvedetails.com/cve/CVE-2016-1181/

CVE-2014-114 is of particular concern as it is already weaponized with a Metasploit module. 

To see attachments, please log in.
Posted: 7 years ago
Posted: 29 Sep 2017 11:31 EDT
Brad Tainter (Br@dTainter_GCS) PEGA Fellow, Technical Support, Platform Service
Pegasystems Inc.
US

Hi RodneyJ5,

Please open a new SR so that we can review the information you have provided along the version(s) of PRPC you are running.  Please include the reference to this Community post in the details of the SR.

Thanks!

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice