CVE-2020-17530 Apache Struts Remote Code Execution
Attackers can execute arbitrary code remotely by exploiting forced OGNL evaluation on raw user input in tag attributes.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17530?
CVE-2020-17530 is a critical code injection vulnerability in Apache Struts, published on 11 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Weakness: CWE-917
Which versions are affected by CVE-2020-17530?
2 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.struts:struts2-core Maven | From 2.0.0 | 2.5.26 |
org.apache.struts:struts2-core Maven | From 2.0.0 | 2.5.26 |
Products include Apache Struts, Oracle Business Intelligence, Oracle Communications Diameter Intelligence Hub, Oracle Communications Policy Management, Oracle Communications Pricing Design Center, Oracle Financial Services Data Integration Hub and 2 more.
How do I fix CVE-2020-17530?
Upgrade org.apache.struts:struts2-core to 2.5.26 or later. US federal agencies must fix it by 3 May 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-17530 being exploited?
Yes. Attackers have exploited CVE-2020-17530 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 12 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-jc35-q369-45pv.