Description
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache Struts 2 < 2.3.1 - Multiple Vulnerabilities EDB-18329 · webapps · Jan 6, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Struts2 S2-008 RCE http/cves/2012/CVE-2012-0392.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | < 2.2.3.1 | 2.2.3.1 | GHSA-2ppp-xj34-vvf7 |
| Maven | org.apache.struts.xwork:xwork-core | < 2.2.3.1 | 2.2.3.1 | GHSA-2ppp-xj34-vvf7 |
References
- 18329 exploit
- 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 mailing-list
- http://struts.apache.org/2.x/docs/version-notes-2311.html
- http://struts.apache.org/2.x/docs/s2-008.html
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt
- [dailydave] 20120106 Apache Struts mailing-list
- 47393 third-party-advisory