PT-2020-5501 · Apache · Apache Struts

Published 2020-12-10 · Updated 2025-10-28 · CVE-2020-17530

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.5.25

Description The issue is caused by incorrect handling of Object Graph Navigation Language (OGNL) expressions, which may lead to remote code execution when evaluated on raw user input in tag attributes. This can allow a remote attacker to execute arbitrary code. The severity of this issue is critical, and a proof-of-concept (PoC) is publicly available, which may have a significant and extensive impact.

Recommendations For Apache Struts versions 2.0.0 through 2.5.25, consider disabling the forced OGNL evaluation in tag attributes to prevent remote code execution until a patch is available. Restrict access to the vulnerable hello.action endpoint to minimize the risk of exploitation. Avoid using the name parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-917

CWE-94

Related Identifiers

BDU:2021-00912

CVE-2020-17530

GHSA-JC35-Q369-45PV

Affected Products

Apache Struts

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_multi_eval_ognl.rb · Exploit
• 🔥 https://github.com/ka1n4t/CVE-2020-17530 · Exploit
• 🔥 https://github.com/wuzuowei/CVE-2020-17530 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-17530 · Exploit
• 🔥 https://github.com/fengziHK/CVE-2020-17530-strust2-061 · Exploit
• 🔥 https://github.com/CyborgSecurity/CVE-2020-17530 · Exploit
• 🔥 https://github.com/uzzzval/CVE-2020-17530 · Exploit
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://security.netapp.com/advisory/ntap-20210115-0005 · Patch
• https://cwiki.apache.org/confluence/display/WW/S2-061 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jc35-q369-45pv · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://osv.dev/vulnerability/CVE-2020-17530 · Vendor Advisory