Apache Struts 2 Vulnerability and its impact on the Wildfly 10.1.0

[billyaung]

Hi Everyone ,

With the recent discovery of RCE vulnerability in Apache Struts 2 , wondering if Wildfly uses Struts in any of the modules/libraries?

Thanks

Apache Struts you're stuffed: Vuln allows hackers to inject evil code into biz servers • The Register

[mchoma]

AFAIK, no. Wildfly delivers RestEasy as REST framework.

[jaikiran]

Struts is a web application development framework that can be used to develop web applications to deploy to (Java EE) servers. WildFly doesn't internally use or rely on Struts. Neither does it package that library.

[gir489]

Yes, there does seem to be a lot of RCE exploits against Struts 2. Our project uses Struts 1. This was chosen for legacy reasons, but a small contributing factor was the large amount of targeted and crafted exploits against the Struts 2 framework.

[billyaung]

Hi ,

@Robert , so Wildfly uses Struts 1?

Forgive me but I have 2 people saying Struts not used and 1 people stating that it does use Struts 1.

Thank you

[ctomc]

There is no version of struts anywhere in WildFly.

Not sure how can I tell that more clearly.

[gir489]

No, read what I said. I said our project uses Struts 1. Wildfly is just an application server.

[billyaung]

Yes. But then you could be one of the developers of Wildfly. If so  , our project = Wildfly.

Yes , I had thought of that you could be having an application project on top of Wildfly and are referencing to it.

But I had to be sure.

Thanks