XStream Library Vulnerability in Apache Struts REST Plugin

CVE-2018-1327

Summary

The Apache Struts REST Plugin leverages the XStream library, which is vulnerable to a Denial of Service (DoS) attack when manipulated by a malicious request containing a specially crafted XML payload. Attackers can exploit this vulnerability to disrupt the application’s availability. To mitigate this risk, users are advised to upgrade to Apache Struts version 2.5.16 or later, and implement the optional Jackson XML handler as outlined in the Apache Struts documentation. Alternatively, a custom XML handler can be created based on the Jackson XML handler included in version 2.5.16.

References