Actively exploited · Published Dec 11, 2020 · Assigned by apache
CVE-2020-17530
Critical 9.8 Exploited
In plain English
A critical-severity expression language injection in Apache Struts from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 96.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.struts:struts2-core | 2.5.26 | GHSA-jc35-q369-45pv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Struts | Struts 2.0.0 - Struts 2.5.25 |
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cwiki.apache.org/confluence/display/WW/S2-061 x_refsource_CONFIRM
- JVN#43969166 third-party-advisory, x_refsource_JVN
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210115-0005/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- [oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17530 government-resource