Description
The Apache Struts framework, when forced, performs double evaluation of attributes’ values assigned to certain tags attributes such as id. This allows attackers to pass in a value that will be evaluated again when a tag’s attributes are rendered. With a carefully crafted request, this vulnerability can lead to Remote Code Execution (RCE).
Recommendation
To mitigate this vulnerability, it is recommended to add proper validation of each value that’s coming in and used in tag’s attributes. Avoid using forced evaluation of an attribute other than value using %{…} or ${…} syntax unless really needed for a valid use-case. Additionally, upgrading to Struts 2.5.22 or newer versions can limit possible malicious effects of forced double evaluation, especially when combined with Proactive OGNL Expression Injection Protection.
References
Could your website be exposed too?
SmartScanner can check your website for Apache Struts 2 Forced double OGNL evaluation S2-059 and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Apache Struts OGNL expression RCE S2-057 - CVE-2018-11776
- Apache Struts 2 RCE S2-045 - CVE-2017-5638
- Apache Struts 2 REST plugin XStream RCE S2-052 - CVE-2017-9805
- Apache 2.4.49 Path Traversal and RCE - CVE-2021-41773, CVE-2021-42013
