CVE-2012-0391 in Struts
Summary
by MITRE
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability identified as CVE-2012-0391 represents a critical remote code execution flaw within the Apache Struts framework that existed in versions prior to 2.2.3.1. This vulnerability specifically affects the ExceptionDelegator component, which serves as a crucial mechanism for handling exceptions during web application processing. The flaw arises from the framework's improper handling of parameter values during exception scenarios, particularly when dealing with mismatched data types for properties. The security implications are severe as the system's exception handling logic inadvertently processes user-supplied parameters as OGNL expressions, creating an avenue for malicious exploitation.
The technical root cause of this vulnerability stems from the improper sanitization and interpretation of input parameters within the exception handling path of the Struts framework. When the ExceptionDelegator component encounters certain data type mismatches during property processing, it attempts to interpret parameter values as OGNL (Object-Graph Navigation Language) expressions rather than treating them as simple string values. This design flaw allows attackers to inject malicious OGNL expressions through carefully crafted parameters that are then evaluated by the framework's OGNL engine. The vulnerability is particularly dangerous because OGNL expressions can execute arbitrary Java code within the context of the web application, potentially leading to complete system compromise.
The operational impact of CVE-2012-0391 extends far beyond simple data corruption or denial of service scenarios. Attackers can leverage this vulnerability to execute arbitrary commands on the affected server, potentially gaining full control over the web application environment. This includes the ability to read sensitive files, modify application data, establish persistent backdoors, and perform lateral movement within the network infrastructure. The vulnerability affects organizations running vulnerable versions of Apache Struts, which was widely adopted across enterprise applications, making it a prime target for exploitation. Security researchers have classified this vulnerability as having high severity due to its remote exploitability and the potential for complete system compromise, with the attack requiring minimal privileges and no authentication.
Mitigation strategies for CVE-2012-0391 primarily focus on immediate version upgrades to Apache Struts 2.2.3.1 or later, which contain the necessary patches to address the improper parameter interpretation during exception handling. Organizations should also implement proper input validation and sanitization measures to reduce the attack surface, particularly when handling user-supplied parameters. Network-level protections such as web application firewalls and intrusion detection systems can help detect and block malicious parameter submissions. Additionally, security teams should conduct thorough vulnerability assessments to identify all instances of vulnerable Struts versions within their infrastructure and ensure proper patch management processes are in place. The vulnerability aligns with CWE-94, which describes the weakness of executing arbitrary code, and maps to ATT&CK technique T1059.007 for executing commands through application-specific interfaces, highlighting the importance of proper input handling and validation in web application security frameworks.