CVE-2013-2251 Apache Struts Improper Input Validation

What is CVE-2013-2251?

CVE-2013-2251 is a critical code injection vulnerability in Apache Struts, published on 18 Jul 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

Weakness: CWE-74

Which versions are affected by CVE-2013-2251?

2 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 4 products.

Products include Apache Archiva, Apache Struts, Fujitsu Interstage Business Process Manager Analytics, Oracle Siebel Apps - E-Billing.

How do I fix CVE-2013-2251?

Upgrade org.apache.struts:struts2-core to 2.3.15.1 or later. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2013-2251 being exploited?

Yes. Attackers have exploited CVE-2013-2251 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Struts

• CVE-2016-4469 Cross-site request forgery in n/a High 8.8
• CVE-2017-5657 Apache Archiva vulnerable to Cross Site Request Forgery High 8.0
• CVE-2024-27138 Apache Archiva: disabling user registration is not effective High 7.5
• CVE-2024-27139 Apache Archiva: incorrect authentication potentially leading to account takeover High 7.5
• CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files High 7.5

All Apache Struts vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-47qp-8v9g-39hp.