Struts 1 Classloader manipulation, can lead to arbitrary code execution

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 5.2 EE SP5 (5.2.9) , 6.0 EE (6.0.10), 6.0 EE SP1 (6.0.11), 6.0 EE SP2 (6.0.12), 6.1 EE GA1 (6.1.10), 6.1 EE GA2 (6.1.20), 6.1 EE GA3 (6.1.30), 6.1.X EE, 6.2 EE GA1 (6.2.10), 6.2.X EE
• Fix Version/s: 6.1.X EE, 6.2.X EE
• Component/s: Application Security
• Labels:
  • 61-ee-ga3-sp2
  • 62-ee-sp5
  • cumulative-security-update-1
  • hotfix
  • hotfix-6120
  • liferay-fixpack-platform-18-6210
  • liferay-fixpack-platform-20-6130
  • lsv-6
• Fix Pack Version/s:
  6.1 EE GA3 (6.1.30)

The fix adds a new property to the portal configuration:

struts.portlet.ignored.parameters.regexp=(.\\.|^|.|\\[('|"))(c|C)lass(
.|('|")]|[).*

If necessary, this default value can be overridden in the portal-ext.properties file.