CVE-2020-17530: S2-061 - Apache Struts 2 Wiki

Summary

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution - similar to S2-059.

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Possible Remote Code Execution vulnerability

Maximum security rating

Important

Recommendation

Upgrade to Struts 2.5.26 or greater

Affected Software

Struts 2.0.0 - Struts 2.5.25

Reporters

Alvaro Munoz - pwntester at github dot com

Masato Anzai of Aeye Security Lab, inc.

CVE Identifier

CVE-2020-17530

Problem

Some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Solution

Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.26 which checks if expression evaluation won’t lead to the double evaluation.

Backward compatibility

No issues expected when upgrading to Struts 2.5.26

Workaround

Do not use forced OGNL evaluation in the tag’s attributes based on untrusted/unvalidated user input, please follow out recommendations from the Security Guide.