CVE-2012-4387 in Struts
Summary
by MITRE
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/20/2019
Apache Struts 2 vulnerable to denial of service through excessive CPU consumption due to improper handling of parameter names that are processed as OGNL expressions. This vulnerability affects versions 2.0.0 through 2.3.4 and represents a critical security flaw that can be exploited by remote attackers to consume excessive system resources. The vulnerability stems from the framework's insufficient validation and sanitization of parameter names during request processing, particularly when these names contain characters that trigger OGNL expression evaluation. When a maliciously crafted parameter name containing OGNL syntax is submitted to the application, the Struts framework attempts to evaluate it as an expression, leading to CPU-intensive processing that can exhaust system resources and render the application unavailable to legitimate users.
The technical flaw manifests in the framework's parameter processing pipeline where parameter names are not adequately sanitized before being passed to the OGNL expression parser. This creates a condition where attacker-controlled input can trigger complex expression evaluation routines that consume disproportionate amounts of CPU cycles. The vulnerability is classified under CWE-400 as an Uncontrolled Resource Consumption flaw, specifically involving excessive CPU usage through malformed input processing. The OGNL (Object-Graph Navigation Language) expression engine within Struts 2 is designed to support dynamic expression evaluation for various framework functionalities, but this feature becomes exploitable when parameter names are not properly validated against potentially dangerous patterns.
The operational impact of this vulnerability extends beyond simple denial of service, as it can be leveraged in distributed denial of service attacks or combined with other exploits to compromise system availability. Attackers can craft parameter names containing OGNL expressions that, when processed, result in recursive or computationally expensive operations that consume significant processing time. This vulnerability affects web applications built on the Apache Struts 2 framework and can be exploited through any HTTP request that accepts parameter input, making it particularly dangerous in applications that process user-supplied data without proper input validation. The attack vector requires no authentication and can be executed against any exposed Struts 2 application, making it a high-risk vulnerability that can be exploited at scale.
Mitigation strategies for this vulnerability include upgrading to Apache Struts 2.3.5 or later versions where the issue has been addressed through improved parameter name validation and sanitization. Organizations should implement comprehensive input validation at multiple layers of their application architecture, including web application firewalls and application-level filters that can detect and block potentially malicious parameter names containing OGNL syntax. The fix implemented in patched versions involves enhanced validation of parameter names to prevent them from being processed as OGNL expressions when they contain dangerous characters or patterns. Security teams should also consider implementing resource limits and monitoring mechanisms to detect unusual CPU consumption patterns that may indicate exploitation attempts. This vulnerability aligns with ATT&CK technique T1499.004 for network denial of service and demonstrates the importance of proper input validation in preventing resource exhaustion attacks through expression evaluation.