CVE-2006-1546

Vulnerability

Apache Struts versions before 1.2.9 contain a vulnerability in the handling of the org.apache.struts.taglib.html.Constants.CANCEL parameter. When a request includes this parameter, the action is canceled, but applications that do not explicitly call the isCancelled method will not detect the cancellation, allowing validation to be bypassed [1].

Exploitation

An attacker can send a crafted HTTP request containing the CANCEL parameter to a Struts action that does not implement the isCancelled check. No authentication is required; the attacker only needs network access to the application [1].

Impact

Successful exploitation allows an attacker to bypass input validation, potentially leading to unintended action execution or data manipulation. The specific impact depends on the application logic, but it can result in unauthorized operations [1].

Mitigation

Upgrade to Apache Struts version 1.2.9 or later, which includes the fix. If upgrading is not possible, ensure that all actions check isCancelled appropriately. The vulnerability is old and likely patched in all modern versions [1][2].