Actively exploited · Published Jan 8, 2012 · Assigned by mitre
CVE-2012-0391
Critical 9.8 Exploited
In plain English
A critical-severity code injection in Struts 2 from Apache. Attackers are actively exploiting it in the wild (listed by CISA on January 21, 2022). The chance it is exploited in the next 30 days is estimated at 75.6% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 21, 2022.
Official description
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.struts.xwork:xwork-core | 2.2.3.1 | GHSA-4wrr-9h5r-m92w |
| Maven | org.apache.struts:struts2-core | 2.2.3.1 | GHSA-4wrr-9h5r-m92w |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 18329 exploit, x_refsource_EXPLOIT-DB
- 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 mailing-list, x_refsource_BUGTRAQ
- http://struts.apache.org/2.x/docs/version-notes-2311.html x_refsource_CONFIRM
- http://struts.apache.org/2.x/docs/s2-008.html x_refsource_CONFIRM
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt x_refsource_MISC
- https://issues.apache.org/jira/browse/WW-3668 x_refsource_CONFIRM
- 47393 third-party-advisory, x_refsource_SECUNIA
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391 government-resource