Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

Vulnerability

The vulnerability resides in Apache Struts 2 versions 2.0.0 through 2.5.29. The fix for CVE-2020-17530 (S2-061) was incomplete, leaving certain tag attributes susceptible to double evaluation when a developer uses the forced OGNL expression syntax %{...} [1][2][3]. If an attacker-controlled value is passed into such an attribute, the OGNL expression is evaluated twice, enabling remote code execution [3].

Exploitation

An attacker must be able to supply untrusted user input that reaches a Struts tag attribute where a developer has applied forced OGNL evaluation using %{...} [1][2]. No authentication is required if the affected endpoint is publicly accessible. The attacker crafts a malicious OGNL expression embedded in the user input, which is then evaluated without proper validation, leading to code execution on the server [3].

Impact

Successful exploitation results in Remote Code Execution (RCE) with the privileges of the Struts application [1][2][3]. This can lead to full compromise of the application server, including data disclosure, modification, or denial of service. The vulnerability is rated Important [3].

Mitigation

Upgrade to Apache Struts 2.5.30 or later, which includes a check to prevent double evaluation [2][3]. As a workaround, avoid using forced OGNL evaluation (%{...}) on untrusted user input in tag attributes [3]. No EOL or KEV listing is noted in the available references.