Apache Struts vulnerabilities

The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.

Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.

In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.

Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.

Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

Apache Struts versions 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.

CookieInterceptor in Apache Struts before version 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, allowing remote attackers to 'manipulate' the ClassLoader and execute arbitrary code via a crafted request.

ParametersInterceptor in Apache Struts before version 2.3.20 does not properly restrict access to the getClass method, allowing remote attackers to manipulate the ClassLoader and execute arbitrary code via a crafted request.

Missing XML validation in Apache Struts allows XML External Entity (XXE) attacks or other XML data manipulation. The vulnerability affects versions from 2.0.0 up to and including 6.1.0.

A vulnerability in Apache Struts related to resource allocation without limits or throttling. Affects Apache Struts versions up to 2.5.30 and 6.1.2.

There is a vulnerability in Apache Struts related to resource allocation without limits or throttling. This issue affects Apache Struts versions up to 2.5.30 and 6.1.2.

In Apache Struts versions 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a remote code execution (RCE) attack.

Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

In Apache Struts 2.x before version 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, a vulnerability allows remote attackers to execute arbitrary code via the stylesheet location parameter.

Apache Struts is vulnerable to uncontrolled resource consumption. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

Apache Struts is vulnerable to uncontrolled resource consumption. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. Applications that do not collect violation reports are not affected.

The JSON plugin of Apache Struts is vulnerable to exposure of data element to wrong session. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

A vulnerability in the JSON plugin of Apache Struts allows per-request parsing state to be shared across concurrent requests, potentially exposing data from one request to another and not enforcing configured parsing limits. Populating actions from JSON request bodies is not enabled by default, so applications not using the JSON plugin are unaffected.

The JSON plugin in Apache Struts has an uncontrolled resource consumption vulnerability. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. Affected versions: Apache Struts from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.