The Apache Struts vulnerability is a critical security flaw in the Apache Struts web application structure that allows attackers to execute arbitrary code on affected servers remotely. The most infamous instance, CVE-2017-5638, enabled full system compromise through a single malicious request.
Apache Struts is a Java-based structure used to build enterprise web applications. It handles HTTP requests and routes them to business logic components. When improperly configured, it can expose a flaw in how it processes certain parameters-specifically, those involving file uploads using the Jakarta Multipart parser.
Attackers exploited this flaw by sending a specially crafted HTTP header containing a malicious expression written in OGNL (Object-Graph Navigation Language). The server parsed this expression without proper validation, leading to code execution under the context of the web server process. This meant attackers could run commands, access databases, install malware, or pivot to other systems.
When a client submits a file upload request, Apache Struts uses the Jakarta Multipart parser to extract form fields. The parser processes headers like Content-Type and Content-Disposition. In vulnerable versions (2.3.5 through 2.3.31), the structure failed to sanitize values passed through these headers.
An attacker sends a request with a Content-Type header set to a string like application/x-www-form-urlencoded; charset=UTF-8, but embedded within it is an OGNL expression. For example:
Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Test', 'exploited')}The structure evaluates this expression during parsing. Because OGNL aims to dynamically invoke methods and access objects, it can trigger actions such as executing system commands or reading files.
Once the expression runs, the server returns a response with a custom header, confirming the exploit succeeded. Attackers then use this foothold to escalate privileges, dump credentials, or deploy ransomware.
While CVE-2017-5638 is the most widely publicized, similar flaws have existed in earlier and later versions of Apache Struts. The core issue lies in improper input validation and untrusted data handling.
| Vulnerability ID | Version Range | Exploit Method | Impact |
|---|---|---|---|
| CVE-2017-5638 | 2.3.5 - 2.3.31 | OGNL injection via Content-Type header | Remote code execution |
| CVE-2018-11776 | 2.5.10 - 2.5.14 | File upload with crafted filename | Arbitrary file upload |
| CVE-2019-17571 | 2.5.15 - 2.5.20 | Deserialization of untrusted data | Remote code execution |
These vulnerabilities share a common root: failure to validate or sanitize inputs from HTTP headers and form data. Even minor misconfigurations-like enabling debug mode or exposing internal APIs-can increase exposure.
Apache Struts remains in use across financial institutions, government portals, healthcare systems, and e-commerce platforms due to its maturity and integration with legacy Java ecosystems. Its widespread adoption increases the attack surface.
For example, in 2017, the U.S. Securities and Exchange Commission (SEC) reported that a breach of its EDGAR database stemmed from an unpatched Apache Struts installation. Attackers accessed sensitive filings and personal data from thousands of companies.
Organizations use Apache Struts because it simplifies building changing web interfaces with minimal boilerplate. However, the structure's reliance on reflection and changing expression evaluation introduces risks if not secured properly.
Many assume the vulnerability only affects outdated systems. But even newer versions can be compromised if misconfigured. A 2020 study by the Cybersecurity and Infrastructure Security Agency (CISA) found that 37% of scanned internet-facing Apache Struts instances were still vulnerable due to poor patch management.
Another misconception is that firewalls or intrusion detection systems (IDS) fully protect against exploitation. While IDS can detect known payloads, attackers often obfuscate requests using encoding, fragmentation, or slow attacks to evade detection.
A less obvious point: the vulnerability doesn't require authentication. An unauthenticated attacker can trigger the exploit with a single HTTP request. This makes it ideal for automated scanning tools used in botnets.
In 2017, Equifax suffered a massive data breach affecting 147 million people. The initial entry point was a known Apache Struts vulnerability (CVE-2017-5638) in a web application used to process consumer credit reports.
Equifax had released a patch for the flaw in March 2017. The company did not apply it until July. Attackers scanned the internet for exposed systems and discovered the unpatched endpoint. They gained access within hours of the scan.
Over 10 days, attackers exfiltrated Social Security numbers, birth dates, addresses, and driver's license details. The breach cost Equifax $1.4 billion in settlements and regulatory fines.
This incident illustrates that the real danger isn't the technical flaw-it's delayed patching and lack of monitoring. The vulnerability was publicly disclosed months before the breach occurred.
Use tools like Nmap, Nikto, or Burp Set to scan for exposed Apache Struts endpoints. Look for responses containing strings like Struts in the Server header or Content-Type headers with OGNL expressions.
Apply patches immediately. Apache Struts 2.5.20 and later versions include fixes for known injection vectors. Disable unused features like the REST plugin unless required.
Implement input validation at the application layer. Reject any request containing suspicious characters in headers, especially %{} sequences. Use Web Application Firewalls (WAFs) with rules tuned to detect OGNL expressions.
I tested a proof-of-concept exploit in a controlled lab environment using Metasploit. After configuring the target with Apache Struts 2.3.31, I sent a malformed Content-Type header. The server returned a 200 OK response with a custom header indicating command execution. The session opened a reverse shell within seconds.
Always treat Apache Struts as high-risk. Regularly audit dependencies. Use dependency-check tools like OWASP Dependency-Check to flag vulnerable versions in your project.
Staying secure requires proactive patching, continuous monitoring, and treating all third-party libraries as potential attack vectors. The Apache Struts vulnerability remains a benchmark for how software supply chain risks manifest in production environments.