Mitigating Struts 2 Vulnerabilities for Experience Manager Forms

Last update: June 24, 2024

CREATED FOR:

  • Admin

Issue

Critical security vulnerabilities have been reported for Struts 2, a popular and open-source web application framework for developing Java EE web applications. The following vulnerabilities have been analyzed:

VulnerabilityWhat’s impacted?What’s not impacted?
CVE-2023-50164Experience Manager 6.5 Forms on JEE (all versions from 6.5 GA to 6.5.19.0)
  • Experience Manager Forms Workbench (all versions)
  • Experience Manager Forms on OSGi (all versions)
  • Experience Manager Forms as a Cloud Service

Resolution

The following table lists resolution for all the impacted versions:

ReleaseCurrent VersionUser action
Experience Manager 6.5 Forms on JEE6.5.19.0Install the latest service pack
Experience Manager 6.5 Forms on JEE6.5.13.0 - 6.5.18.0

Use one of the following methods:

Experience Manager 6.5 Forms on JEE6.5 - 6.5.12.0Install the latest service pack

NOTE: AEM Forms currently support versions 6.5.13.0 through 6.5.19.0. If you’re using an older version, we recommend upgrading to 6.5.13.0 or a later release. For instructions to install AEM 6.5.13.0 or later release, see release notes.

Use manual mitigation steps

You can use the manual mitigation steps to resolve the issue on AEM 6.5 Form Server running Service Pack 13 to AEM 6.5 Form Server running Service Pack 18 (6.5.13.0 - 6.5.18.0):

  1. Download the struts-core 2.5.33 jar to a local folder. For example, C:\Users\labuser\Desktop\struts2-core-2.5.33.jar.

  2. Download the AEM Forms on JEE Manual Patching Tool from Software Distribution.

  3. Unzip the manual patching tool archive. For example, extract to the /Users/labuser/Desktop/archive-patcher-1.0.0 folder. The following files are extracted:

    • archive-patcher-1.0.0.jar
    • patch-archive.bat
    • patch-archive.sh

  1. Shut down all the server instances and locators.

  2. Open the terminal window and navigate to the folder containing the AEM Forms on JEE Manual Patching Tool (extracted files).

  3. Run the following command to search all the files with older struts2 libraries. Before running the command, replace the path in the command with the path of your AEM Forms Server:

    
patch-archive.bat -root=C:\Adobe\Adobe_Experience_Manager_Forms\configurationManager\export -pattern=.*struts2-core.*jar$
    NOTE
    The tool requires internet connectivity as it downloads dependencies at runtime. So, before running the tool, ensure that you are connected to internet.

  4. Run the following commands in the listed order for recursive in-place replacement. Before running the command, replace the path in the command with the path of your AEM Forms Server and the struts2-core-2.5.33.jar file.

    
patch-archive.bat -root=C:\Adobe\Adobe_Experience_Manager_Forms\configurationManager\export -pattern=.*struts2-core.*jar$ -action=replace C:\Users\labuser\Desktop\struts2-core-2.5.33.jar

    The above steps patch all the ear files with older struts2 libraries.

  5. Undeploy the older EAR and deploy the patched EAR file, available in the export folder, to your application server.

  6. Start your AEM Forms Server.

  1. Shut down all the server instances and locators.

  2. Open the terminal window and navigate to the folder containing the AEM Forms on JEE Manual Patching Tool (extracted files).

  3. Run the following command to search all the files with older struts2 libraries. Before running the command, replace the path in the command with the path of your AEM Forms Server:

    
./patch-archive.sh -root=/opt/Adobe/Adobe_Experience_Manager_Forms/configurationManager/export/ -pattern=.*struts2-core.*jar$
    NOTE
    The tool requires internet connectivity as it downloads dependencies at runtime. So, before running the tool, ensure that you are connected to internet.

  4. Run the following commands in the listed order for recursive in-place replacement. Before running the command, replace the path in the command with the path of your AEM Forms Server and the struts2-core-2.5.33.jar file.

    
./patch-archive.sh -root=/opt/Adobe/Adobe_Experience_Manager_Forms/configurationManager/export/ -pattern=.*struts2-core.*jar$ -action=replace /opt/struts2-core-2.5.33.jar

    The above steps patch all the ear files with older struts2 libraries.

  5. Undeploy the older EAR and deploy the patched EAR file, available in the export folder, to your application server.

  6. Start your AEM Forms Server.

Experience Manager


Espressos & Experience Manager: AEM Forms

Espressos & Experience Manager

Thursday, Mar 6, 7:00 PM UTC

Join Adobe's AEM product team as they highlight AEM Forms' latest innovations, including: the new Gen AI Assistant, Unified Composition with AEM Sites, and new ways to deploy forms through conversations.

Register

Elevate and Empower Teams with Agentic AI for Exceptional Experiences

Online | Strategy Keynote | General Audience

Elevate and empower your CX teams with AI that transforms creativity, personalization, and productivity. Discover how Adobe is...

Tue, Mar 18, 1:00 PM PDT (8:00 PM UTC)

Register

Unlocking Content at Scale with Havas POP and Adobe GenStudio

In-person | Session | General Audience

In today’s fast-paced market, a brand's relevance is directly linked to its latest content. With a network of over 23,000 professionals...

Tue, Mar 18, 4:00 PM PDT (11:00 PM UTC)

Register

Connect with Experience League at Summit!

Get front-row access to top sessions, hands-on activities, and networking—wherever you are!

Learn more

Register now