Loading vulnerability…
Apache Struts Double OGNL Evaluation Remote Code Execution
CVE-2019-0230 is an OGNL expression injection vulnerability in Apache Struts 2.0.0 through 2.5.20. When an application evaluates raw user input in tag attributes using forced double OGNL evaluation, attacker-controlled expressions may be interpreted and executed, potentially resulting in remote code execution. Apache Struts 2.5.22 addresses the vulnerable attack vector.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may allow arbitrary code execution in the affected Apache Struts application. The execution privilege level and specific confidentiality or availability consequences are not established.
If you can’t patch tonight, do this now.
Remove or refactor application behavior that passes raw, attacker-controlled input into tag attributes subject to forced double OGNL evaluation. Prevent untrusted values from being interpreted as OGNL expressions.
Patch, then assume compromise.
Upgrade Apache Struts to version 2.5.22 or a later supported release that includes the fix. For products embedding Struts, apply the applicable vendor update containing the corrected component.
2 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.