CVE-2013-2251: Apache Struts Improper Input Validation Vulnerability
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
Other sources
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
— CISA
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 2.3.15.1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2251?
CVE-2013-2251 is classified as a critical vulnerability due to its potential for remote code execution through crafted input.
How can I mitigate CVE-2013-2251?
To mitigate CVE-2013-2251, ensure that you update to Apache Struts version 2.3.15.1 or later.
What versions of Apache Struts are affected by CVE-2013-2251?
CVE-2013-2251 affects Apache Struts versions from 2.0.0 to 2.3.15.
What types of attacks can CVE-2013-2251 enable?
CVE-2013-2251 can enable remote attackers to execute arbitrary OGNL expressions, potentially leading to full system compromise.
Is there a patch available for CVE-2013-2251?
Yes, a patch is available by upgrading to Apache Struts version 2.3.15.1 or newer.