|
Description
|
On a form with
<s:textfield name="xxx">
if the user enters %{xxx} as the value then com/opensymphony/xwork2/util/TextParseUtil.translateVariables enters an infinite loop eating about 1GB of ram in one second on my server.
|
All user input, for example entered through a form, is evaluated as an OGNL expression.
This leads to a remote exploit of possible malicious code execution of any kind, such as server shutdown or information theft.
Moreover, it can lead to a DoS problem:
On a form with:
<s:textfield name="xxx">
if the user enters %{xxx} as the value then com/opensymphony/xwork2/util/TextParseUtil.translateVariables enters an infinite loop eating about 1GB of ram in one second on my server.
|
|
Summary
|
DOS (continuos memory eating on an infinte loop) on form fields
|
User input is evaluated as an OGNL expression
|
Bug
Resolved
Critical
User input is evaluated as an OGNL expression
