CVE-2019-0230

Vulnerability

CVE-2019-0230 is a remote code execution vulnerability in Apache Struts 2 that affects versions 2.0.0 through 2.5.20. The root cause is a forced double evaluation of OGNL (Object-Graph Navigation Language) expressions when they are assigned to certain tag attributes, such as id [3]. When the framework performs this double evaluation on raw, unvalidated user input, an attacker can inject malicious OGNL expressions that get executed server-side [3].

Exploitation

Exploitation is possible when an attacker can control a value that is used in a Struts tag attribute that supports forced OGNL evaluation (using the %{...} or ${...} syntax) and that value references unvalidated input [3]. The attacker crafts a request containing an OGNL expression as the value for a parameter that ultimately is placed into a tag attribute like id [3]. When the tag is rendered, the expression is evaluated twice, leading to code execution [3]. No authentication is required, but the attacker must be able to influence a specific input that ends up in a vulnerable tag attribute.

Impact

Successful exploitation allows an attacker to execute arbitrary Java code on the server with the privileges of the web application, potentially leading to full server compromise, data theft, or other malicious actions [1][3].

Mitigation

The vulnerability is addressed in Apache Struts 2.5.22. Users should upgrade to this version or later [3]. As a workaround, avoid using forced OGNL evaluation (%{...} or ${...}) in tag attributes unless absolutely necessary, and ensure all user-supplied values are properly validated before being used in such expressions [3]. The issue is similar to previous Struts vulnerabilities such as S2-029 and S2-036 [3].