CWE-102: Struts: Duplicate Validation Forms

What is Struts: Duplicate Validation Forms?

• Overview:

• CWE-102 relates to using multiple validation forms with the same name in Apache Struts, which can lead to unexpected validation behavior as the Struts Validator arbitrarily chooses one form over another.

• Exploitation Methods:

• Attackers can exploit this vulnerability by manipulating form inputs to trigger unintended validation paths.
• Common attack patterns include sending crafted inputs to bypass expected validation rules, potentially leading to unauthorized actions or data leaks.

• Security Impact:

• Direct consequences include incorrect validation, leading to potential security lapses such as injection attacks or privilege escalation.
• Potential cascading effects involve undermining the integrity of the application's validation logic, possibly exposing other vulnerabilities.
• Business impact can include data breaches, legal liabilities, and damage to brand reputation due to security failures.

• Prevention Guidelines:

• Specific code-level fixes include ensuring that each validation form has a unique name and updating validation logic to reflect current application requirements.
• Security best practices involve regularly auditing validation configurations and maintaining a single source of truth for form validation schemas.
• Recommended tools and frameworks include using the latest version of Struts with updated security patches and employing static analysis tools to detect duplicate form names or other validation issues.

Corgea can automatically detect and fix Struts: Duplicate Validation Forms in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Java

Affected Technologies: Not specified

Vulnerable Code Example

Java Example

public class LoginForm extends ActionForm {
    private String username;
    private String password;

    // Vulnerable: The form name 'loginForm' is duplicated in the configuration,
    // which can lead to the wrong form being validated by the Struts Validator.
    public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
        ActionErrors errors = new ActionErrors();
        if (username == null || username.length() < 1) {
            errors.add("username", new ActionMessage("error.username.required"));
        }
        if (password == null || password.length() < 1) {
            errors.add("password", new ActionMessage("error.password.required"));
        }
        return errors;
    }
}

public class RegistrationForm extends ActionForm {
    private String username;
    private String password;
    private String email;

    // Vulnerable: The form name 'loginForm' is duplicated in the configuration,
    // which can result in incorrect validation being applied to this form.
    public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
        ActionErrors errors = new ActionErrors();
        if (username == null || username.length() < 1) {
            errors.add("username", new ActionMessage("error.username.required"));
        }
        if (password == null || password.length() < 1) {
            errors.add("password", new ActionMessage("error.password.required"));
        }
        if (email == null || email.length() < 1) {
            errors.add("email", new ActionMessage("error.email.required"));
        }
        return errors;
    }
}

How to fix Struts: Duplicate Validation Forms?

To fix the issue of duplicate validation forms, ensure that each form has a unique name in the struts-config.xml file. This can be achieved by assigning different form names to each form and using these unique names in the associated JSP files. This prevents the Struts Validator from mistakenly validating the wrong form, which can lead to unpredictable behavior and security issues.

Fixed Code Example

<struts-config>
    <!-- Fixed: Unique form names for each form -->
    <form-beans>
        <form-bean name="loginForm" type="com.example.LoginForm"/>
        <form-bean name="registrationForm" type="com.example.RegistrationForm"/>
    </form-beans>
</struts-config>

public class LoginForm extends ActionForm {
    private String username;
    private String password;

    // Validation logic specific to LoginForm
    public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
        ActionErrors errors = new ActionErrors();
        if (username == null || username.length() < 1) {
            errors.add("username", new ActionMessage("error.username.required"));
        }
        if (password == null || password.length() < 1) {
            errors.add("password", new ActionMessage("error.password.required"));
        }
        return errors;
    }
}

public class RegistrationForm extends ActionForm {
    private String username;
    private String password;
    private String email;

    // Validation logic specific to RegistrationForm
    public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {
        ActionErrors errors = new ActionErrors();
        if (username == null || username.length() < 1) {
            errors.add("username", new ActionMessage("error.username.required"));
        }
        if (password == null || password.length() < 1) {
            errors.add("password", new ActionMessage("error.password.required"));
        }
        if (email == null || email.length() < 1) {
            errors.add("email", new ActionMessage("error.email.required"));
        }
        return errors;
    }
}

In the fixed code example, the struts-config.xml file is properly configured with unique form names for each form. This prevents the Struts Validator from confusing one form with another, thus avoiding the security issue of duplicate validation forms. The LoginForm and RegistrationForm classes remain unchanged, but they now correspond to uniquely named form beans in the configuration, ensuring that each form is validated as expected.