Struts2被爆严重漏洞,完美解决方案

Struts2被爆出严重漏洞,现解决方案如下(亲测):
升级到struts-2.3.15.1即可解决!

1, 删除lib包

struts2-core-2.0.14.jar,ognl-2.6.11.jar,commons-lang-2.1.jar,xwork-2.0.7.jar

2, 增加lib包

struts2-core-2.3.15.1.jar,xwork-core-2.3.15.1.jar,ognl-3.0.6.jar,javassist-3.11.0.GA.jar,commons-lang3-3.1.jar

增加lib包下载地址:
http://mirror.bit.edu.cn/apache//struts/binaries/struts-2.3.15.1-all.zip

3, 修改web.xml
<filter>
  <filter-name>struts2</filter-name>
  <filter-class>org.apache.struts2.dispatcher.FilterDispatcher
</filter-class>
  </filter>
  <filter-mapping>
  <filter-name>struts2</filter-name>
  <url-pattern>/*</url-pattern>
  </filter-mapping>

改为:
<filter>
  <filter-name>struts2</filter-name>
  <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter
</filter-class>
  </filter>
  <filter-mapping>
  <filter-name>struts2</filter-name>
  <url-pattern>/*</url-pattern>
  </filter-mapping>
完美解决!

详细漏洞信息:

http://struts.apache.org/release/2.3.x/docs/s2-016.html
http://struts.apache.org/release/2.3.x/docs/s2-017.html
http://struts.apache.org/release/2.3.x/docs/version-notes-23151.html

你可能感兴趣的:(漏洞,struts2,解决方案)