Apache Struts2 S2-052 RCE

Apache Struts 2 is a sophisticated, extensible platform for developing enterprise-grade Java web applications. The bug is caused by improper deserialization in the Java Struts REST plugin. When deserializing XML payloads, the REST Plugin in Apache Struts 2.1.2 through 2.3.x prior to 2.3.34 and 2.5.x prior to 2.5.13 employs a XStreamHandler with an instance of XStream without any type filtering, which can result in Remote Code Execution.Remote code execution is possible because the Struts REST plugin does not have input validation or sanitization.

Mitigation / Precaution

• If your web application server is running one of the affected versions, please upgrade it as soon as possible to Struts 2.3.34 or Struts 2.5.13.
• Other alternative is to restrict the plugin mostly to server normal pages and JSONs

Written by

Nash N Sulthan

Cyber Security Lead Engineer

Nash is a seasoned Security Engineer who brings a multifaceted approach to safeguarding digital environments. Not only does he excel in implementing robust security measures, but he's also deeply involved in the research and development process, constantly innovating to stay ahead of cyber threats. Nash's commitment to security extends beyond the conventional, making him a valuable contributor to the evolving landscape of digital defense.