Apache Struts2 S2-057 RCE

Apache Struts is a free and open-source framework used to build Java web applications. Apache Struts2 S2-057 has a remote code execution vulnerability. When alwaysSelectFullNamespace is true (either by the user or by a plugin like Convention Plugin), Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 are vulnerable to Remote Code Execution. Results are used with no namespace and, at the same time, its upper package has no or wildcard namespace; similarly, when using url tags with no value and action set and, at the same time, its upper package has no or wildcard namespace; and, similarly to results, when using url tags with no value and action set and, at the same time, its upper package has no or wildcard namespace.

Mitigation / Precaution

• Don’t use Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16

Written by

Jijith Rajan

Cyber Security Engineer

His passion for staying abreast of the latest security threats and trends, coupled with his hands-on experience, allows him to actively contribute to the protection of digital assets. Jijith's dedication and enthusiasm make him a promising talent in the ever-evolving realm of cybersecurity, promising a safer digital future.