Apache Struts vulnerabilities

The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.

Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.

In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.

Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.

Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.

CookieInterceptor in Apache Struts before version 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, allowing remote attackers to 'manipulate' the ClassLoader and execute arbitrary code via a crafted request.

ParametersInterceptor in Apache Struts before version 2.3.20 does not properly restrict access to the getClass method, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request.

An Expression Language Injection vulnerability exists in Apache Struts due to improper neutralization of special elements. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled, which is enabled by default.

Missing XML validation in Apache Struts allows XML External Entity (XXE) attacks or other XML data manipulation. The vulnerability affects versions from 2.0.0 up to and including 6.1.0.

A vulnerability in Apache Struts related to resource allocation without limits or throttling. Affects Apache Struts versions up to 2.5.30 and 6.1.2.

There is a vulnerability in Apache Struts related to resource allocation without limits or throttling. This issue affects Apache Struts versions up to 2.5.30 and 6.1.2.

In Apache Struts versions 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a remote code execution (RCE) attack.

Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

In Apache Struts 2.x before version 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, a vulnerability allows remote attackers to execute arbitrary code via the stylesheet location parameter.

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.

A resource allocation without limits vulnerability exists in the Apache Struts REST plugin. A request body is read into memory without any bound on its size, so a single request can exhaust the Java heap and deny service to other users. No additional setting needs to be enabled, and only applications using the REST plugin are affected.

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (BigDecimal) property and rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request. This allows an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic.

Apache Struts is vulnerable to uncontrolled resource consumption. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

Apache Struts is vulnerable to uncontrolled resource consumption. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. Applications that do not collect violation reports are not affected.

The JSON plugin of Apache Struts is vulnerable to exposure of data element to wrong session. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

A vulnerability in the JSON plugin of Apache Struts allows per-request parsing state to be shared across concurrent requests, potentially exposing data from one request to another and not enforcing configured parsing limits. Populating actions from JSON request bodies is not enabled by default, so applications not using the JSON plugin are unaffected.

The JSON plugin in Apache Struts has an uncontrolled resource consumption vulnerability. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. Affected versions: Apache Struts from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.