Is Symantec VIP and its components vulnerable to CVE-2024-53677

Products

• VIP Service

Issue/Introduction

CVE-2024-53677 is a critical path traversal vulnerability in the Apache Struts framework's file upload handling mechanism. Attackers can exploit this flaw by manipulating file upload parameters to traverse directory boundaries, enabling the upload of malicious files to arbitrary locations on the server. Successful exploitation can lead to remote code execution (RCE) under the privileges of the web application process.

The vulnerability resides specifically in the FileUploadInterceptor component of Apache Struts. Applications that do not invoke this interceptor in their action pipeline are not exposed to the attack surface introduced by this CVE.

Is Symantec VIP vulnerable to this CVE-2024-53677​?

Environment

VIP Service

VIP Enterprise Gateway 9.11.x

Cause

CVE-2024-53677 is a critical vulnerability affecting Apache Struts versions 2.0.0 through 6.3.0.2. This issue arises from flawed file upload logic, which allows attackers to manipulate file upload parameters and potentially execute remote code. The vulnerability involves CWE-434 (Unrestricted Upload of File with Dangerous Type), enabling attackers to bypass file upload checks under certain conditions.

Resolution

CVE-2024-53677 requires the target application to have the Apache Struts FileUploadInterceptor active in its request processing chain. Symantec VIP does not configure or invoke this interceptor at any point in its architecture.

As a result, the exploit path for this vulnerability does not exist within Symantec VIP. The product's file upload handling does not rely on the affected Struts component, and no malicious path traversal payload can reach the vulnerable code path. Symantec VIP is not vulnerable to CVE-2024-53677 due to its architecture not utilizing the Apache Struts FileUploadInterceptor. Customers do not need to apply any patches or modify any configuration settings in response to this advisory.

Although Symantec VIP Enterprise Gateway is not vulnerable, Enterprise Gateway version 9.11.2 includes a full remediation for CVE-2024-53677. Apache Struts has been upgraded to version 6.4.0 in this release, which contains the official upstream fix for the FileUploadInterceptor path traversal vulnerability.

This is the recommended resolution for all affected EGW deployments.

Additional Information

For further information, see the official Apache Struts advisory: Apache Struts S2-067