PT-2016-5363 · Apache · Apache Struts

Nixawk · Published 2016-06-07 · Updated 2026-01-17 · CVE-2016-3087

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.3.19 through 2.3.28

Description The issue allows remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin when Dynamic Method Invocation is enabled.

Recommendations For Apache Struts versions 2.3.19 through 2.3.28, consider disabling Dynamic Method Invocation as a temporary workaround until a patch is available. Restrict access to the REST Plugin to minimize the risk of exploitation. Avoid using the ! operator in the affected REST Plugin until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-3087

GHSA-MMJ6-CJJ4-HPR5

Affected Products

Apache Struts

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_dmi_rest_exec.rb · Exploit
• 🔥 https://github.com/nixawk/labs/tree/master/CVE-2016-3087 · Exploit
• 🔥 https://exploit-db.com/exploits/43382 · Exploit
• 🔥 https://exploit-db.com/exploits/39919 · Exploit
• http://struts.apache.org/docs/s2-033.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3087 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3087 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmj6-cjj4-hpr5 · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/6bd694b7980494c12d49ca1bf39f12aec3e03e2f · Note
• https://web.archive.org/web/20160728170709/http://securityfocus.com/bid/90960 · Note
• http://securitytracker.com/id/1036017 · Note
• https://web.archive.org/web/20160616082237/http://securitytracker.com/id/1036017 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21987854 · Note
• http://securityfocus.com/bid/90960 · Note