Security researchers from Trend Micro reported in August that Chinese hackers are attacking servers running Apache Struts applications by using an automated tool that exploits several Apache Struts remote command execution vulnerabilities, including CVE-2013-2251.
The existence of an attack tool in the cybercriminal underground for exploiting Struts vulnerabilities increases the risk for organizations using the affected Cisco products.
In addition, since patching CVE-2013-2251 the Apache Struts developers have further hardened the DefaultActionMapper component in more recent releases.
Struts version 18.104.22.168, which was released in September, made some changes to the DefaultActionMapper "action:" prefix that's used to attach navigational information to buttons within forms in order to mitigate an issue that could be exploited to circumvent security constraints. The issue has been assigned the CVE-2013-4310 identifier.
Struts 22.214.171.124, released on Oct. 17, turned off support for the "action:" prefix by default and added two new settings called "struts.mapper.action.prefix.enabled" and "struts.mapper.action.prefix.crossNamespaces" that can be used to better control the behavior of DefaultActionMapper.
The Struts developers said that upgrading to Struts 126.96.36.199 is strongly recommended, but held back on releasing more details about CVE-2013-4310 until the patch is widely adopted.
It's not clear when or if Cisco will patch CVE-2013-4310 in its products, giving that the fix appears to involve disabling support for the "action:" prefix. If the Struts applications in those products use the "action:" prefix the company might need to rework some of their code.