logo

Database

Remote command execution In org.apache.struts:struts2-core

Description

Expression Language Injection in Apache Struts The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2021-318052. NVD-2021-318053. OSV-2021-318054. GCVE-2021-31805

References

1. https://cwiki.apache.org/confluence/display/WW/S2-0622. https://security.netapp.com/advisory/ntap-20220420-00013. https://www.oracle.com/security-alerts/cpujul2022.html4. http://www.openwall.com/lists/oss-security/2022/04/12/65. https://vulncheck.com/cve/CVE-2021-318056. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-31805.yaml7. https://github.com/pyroxenites/s2-0628. https://security.netapp.com/advisory/ntap-20220420-0001/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.