exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Apache Struts2 File Overwrite / Command Execution

Apache Struts2 File Overwrite / Command Execution
Posted Jan 6, 2012
Authored by Johannes Dahse, Andreas Nusser | Site sec-consult.com

Apache Struts2 versions and below suffer from an ExceptionDelegator remote command execution vulnerability. Versions 2.3.1 and below suffer from remote command execution vulnerabilities related to CookieInterceptor and DebuggingInterceptor. Versions 2.3.1 and below suffer from a file overwrite vulnerability in ParametersInterceptor.

tags | exploit, remote, vulnerability
SHA-256 | 8d363a18f897ed34231b59c495249b3756d6dd28557f389c633b72c05f3bea07

Apache Struts2 File Overwrite / Command Execution

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20120104-0 >
title: Multiple critical vulnerabilities in Apache Struts2
product: Apache Struts2
* OpenSymphony XWork
* OpenSymphony OGNL
vulnerable version: 2.3.1 and below
fixed version:
impact: critical
homepage: http://struts.apache.org/
found: 2011-11-18
by: Johannes Dahse, Andreas Nusser
SEC Consult Vulnerability Lab

Vendor description:
Apache Struts2 is a web framework for creating Java web applications.
It is using the OpenSymphony XWork and OGNL libraries. By default,
XWork's ParametersInterceptor treats parameter names provided to
actions as OGNL expressions. A OGNL (Object Graph Navigation Language)
expression is a limited language similar to Java that is tokenized and
parsed by the OGNL parser which invokes appropiate Java methods. This
allows e.g. convenient access to properties that have a getter/setter
method implemented. By providing a parameter like "product.id=1" the
OGNL parser will call the appropiate setter getProduct().setId(1) in
the current action context. OGNL is also able to call arbitrary
methods, constructors and access context variables. For more details
please refer to http://commons.apache.org/ognl/language-guide.html.

Vulnerability overview/description:
To prevent attackers calling arbitrary methods within parameters the
flag "xwork.MethodAccessor.denyMethodExecution" is set to "true" and the
SecurityMemberAccess field "allowStaticMethodAccess" is set to "false"
by default. Also, to prevent access to context variables an improved
character whitelist for parameter names is applied in XWork's
ParametersInterceptor since Struts

acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[\\(\\)_'\\s]+";

Under certain circumstances these restrictions can be bypassed to
execute malicious Java code.

1.) Remote command execution in Struts <= (ExceptionDelegator)

When an exception occurs while applying parameter values to properties
the value is evaluated as OGNL expression. For example this occurs when
setting a string value to a property with type integer. Since the
values are not filtered an attacker can abuse the power of the OGNL
language to execute arbitrary Java code leading to remote command
execution. This issue has been reported
(https://issues.apache.org/jira/browse/WW-3668) and was fixed in Struts However the ability to execute arbitrary Java code has been

2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)

The character whitelist for parameter names is not applied to Struts
CookieInterceptor. When Struts is configured to handle cookie names, an
attacker can execute arbitrary system commands with static method
access to Java functions. Therefore the flag "allowStaticMethodAccess"
can be set to true within the request.

3.) Arbitrary File Overwrite in Struts <= 2.3.1 (ParametersInterceptor)

Accessing the flag "allowStaticMethodAccess" within parameters is
prohibited since Struts An attacker can still access public
constructors with only one parameter of type String to create new Java
objects and access their setters with only one parameter of type
String. This can be abused for example to create and overwrite
arbitrary files. To inject forbidden characters to the filename an
uninitialized string property can be used.

4.) Remote command execution in Struts <= 2.3.1 (DebuggingInterceptor)

While not being a security vulnerability itself, please note that
applications running in developer mode and using Struts
DebuggingInterceptor are prone to remote command execution as well.
While applications should never run in developer mode during
production, developers should be aware that doing so not only has
performance issues (as documented) but also a critical security impact.

Proof of concept:

1.) Remote command execution in Struts <= (ExceptionDelegator)

Given Test.java has an property "id" of type Integer or Long and
appropriate getter and setter methods:
long id;

Given test.jsp with result name=input is configured for action "Test":
<action name="Test" class="example.Test">
<result name="input">test.jsp</result>

The following request will trigger an exception, the value will be
evaluated as OGNL expression and arbitrary Java code can be executed:


An attacker can also overwrite flags that will allow direct OS
command execution:

If test.jsp displays the property "id" the result of the Java code
evaluation can be accessed:
<%@ taglib prefix="s" uri="/struts-tags" %>
<s:property value="id" />

2.) Remote command execution in Struts <= 2.3.1 (CookieInterceptor)

Given struts.xml is configured to handle all cookie names (independent
of limited cookie values):
<action name="Test" class="example.Test">
<interceptor-ref name="cookie">
<param name="cookiesName">*</param>
<param name="cookiesValue">1,2</param>
<result ...>

The following HTTP header will execute an OS command when sent to
Cookie: (#_memberAccess["allowStaticMethodAccess"]\u003dtrue)(x)=1;

3.) Arbitrary File Overwrite in Struts <= 2.3.1 (ParametersInterceptor)

Given Test.java has an uninitialized property "name" of type String:
String name; // +getter+setter

The following request will create/overwrite the file
"C:/sec-consult.txt" (empty file):

The existence of the property 'x' used in these examples is of no

4.) Remote command execution in Struts <= 2.3.1 (DebuggingInterceptor)

Given struts.xml is configured to run in developer mode and to use the
debugging interceptor:
<constant name="struts.devMode" value="true" />
<action name="Test" class="example.Test">
<interceptor-ref name="debugging" />
<result ...>

The following request will execute arbitrary OGNL expressions leading
to remote command execution:

Vulnerable / tested versions:
All products using Struts2 are affected by at least one critical
vulnerability listed above!

Proof of Concept 1.) has been tested with Jetty-6.1.25 26 July 2010 and

Proof of Concepts 2.), 3.) and 4.) have been tested with Jetty-6.1.25
26 July 2010 and Struts, and 2.3.1

Vendor contact timeline:
2011-12-14: Contacting vendor through security at struts dot apache dot
2011-12-14: Vendor reply, sending advisory draft
2011-12-14: Vendor released Apache Struts 2.3.1 in parallel
2011-12-16: Vulnerabilities confirmed in Struts 2.3.1, Vendor contacted
2011-12-16: Vendor reply, discussing workaround
2011-12-20: Discussing release of fixed version
2011-12-21: Providing additional information
2012-01-03: Vendor informs that update is ready
2012-01-03: Patch ( is available

Update to Struts

Update to Struts 2.3.1 and apply a stronger acceptedParamNames filter
to the Parameters- and CookieInterceptor:

acceptedParamNames = "[a-zA-Z0-9\\.\\]\\[_']+";

Don't run your applications in developer mode.

Advisory URL:

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF J. Dahse, A. Nusser / 2012
Login or Register to add favorites

File Archive:

June 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    18 Files
  • 2
    Jun 2nd
    13 Files
  • 3
    Jun 3rd
    0 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    32 Files
  • 6
    Jun 6th
    39 Files
  • 7
    Jun 7th
    22 Files
  • 8
    Jun 8th
    17 Files
  • 9
    Jun 9th
    20 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By