CVE-2016-0785 in Struts
Summary
by MITRE
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/02/2019
Apache Struts 2 versions prior to 2.3.28 contain a critical vulnerability that enables remote code execution through a specific OGNL expression evaluation mechanism. This vulnerability arises from a flaw in how the framework processes tag attributes containing the "%{}" sequence, which triggers a forced double OGNL evaluation process that can be exploited by attackers to execute arbitrary code on the affected server. The vulnerability specifically affects the way Struts 2 handles parameter binding and expression evaluation within its tag libraries, creating an unintended code execution path that bypasses normal input validation mechanisms.
The technical root cause of this vulnerability lies in the improper handling of OGNL (Object-Graph Navigation Language) expressions within tag attributes. When the framework encounters a "%{}" sequence in a tag attribute, it performs an initial evaluation of the contained expression, followed by a second evaluation that can be manipulated by attackers to execute malicious code. This double evaluation process creates a vector where attacker-controlled input can be interpreted as executable code rather than simple data. The vulnerability is classified as a CWE-94 weakness, specifically related to the execution of arbitrary code due to improper input validation and expression evaluation. This weakness allows attackers to leverage the framework's legitimate expression evaluation capabilities for malicious purposes.
The operational impact of this vulnerability is severe and far-reaching, as it provides attackers with complete remote code execution capabilities on affected systems. An attacker can leverage this vulnerability to execute arbitrary commands, access sensitive data, compromise the entire application server, or use the compromised system as a pivot point for further attacks within the network. The vulnerability affects any application built on Apache Struts 2 that processes user input through tag attributes, making it particularly dangerous in web applications that accept user-supplied data. This type of vulnerability aligns with ATT&CK technique T1059, which describes the use of command and scripting interpreters to execute malicious code, and T1133, which covers external remote services that can be exploited for code execution.
Organizations should immediately upgrade to Apache Struts 2 version 2.3.28 or later to remediate this vulnerability, as no effective workarounds exist for this specific flaw. The patch addresses the core issue by implementing proper input validation and preventing the forced double evaluation of OGNL expressions in tag attributes. Security teams should also implement network segmentation, monitor for suspicious patterns in application logs, and conduct thorough vulnerability assessments of all Struts 2 applications in their environment. Additionally, organizations should consider implementing web application firewalls and runtime application self-protection mechanisms to detect and prevent exploitation attempts. The vulnerability demonstrates the critical importance of proper input validation and expression evaluation in web frameworks, as even legitimate features can become security risks when not properly secured against malicious manipulation.