Description
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | Struts 2.0.0 - Struts 2.5.25 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Struts 2 Forced Multi OGNL Evaluation
exploit/multi/http/struts2_multi_eval_ognl
GitHub 12 repositories · most starred shown
-
ka1n4t/CVE-2020-17530 ★ 64 · Dec 9, 2020
-
wuzuowei/CVE-2020-17530 ★ 45 · Dec 10, 2020
S2-061 的payload，以及对应简单的PoC/Exp
-
Al1ex/CVE-2020-17530 ★ 29 · Dec 13, 2020
S2-061 CVE-2020-17530
-
fengziHK/CVE-2020-17530-strust2-061 ★ 7 · Dec 14, 2020
CVE-2020-17530-strust2-061
-
uzzzval/CVE-2020-17530 ★ 5 · Jan 7, 2021
-
CyborgSecurity/CVE-2020-17530 ★ 4 · Dec 30, 2020
-
secpool2000/CVE-2020-17530 ★ 1 · Dec 9, 2020
Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞（CVE-2020-17530），在使用某些tag等情况下可能存在OGNL表达式注入漏洞，从而造成远程代码执行，风险极大。提醒我校Apache Struts用户尽快采取安全措施阻止漏洞攻击。
-
keyuan15/CVE-2020-17530 ★ 0 · Apr 2, 2023
Struts2 S2-061 远程命令执行漏洞（CVE-2020-17530）
-
killmonday/CVE-2020-17530-s2-061 ★ 0 · Jan 24, 2021
-
ludy-dev/freemarker_RCE_struts2_s2-061 ★ 0 · Dec 18, 2020
(cve-2020-17530) struts2_s2-061 freemarker_RCE testscript
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Struts 2.0.0-2.5.25 - Remote Code Execution http/cves/2020/CVE-2020-17530.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.0, < 2.5.26 | 2.5.26 | GHSA-jc35-q369-45pv |
Advisories 1
- WID-SEC-2023-0065 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
References
- https://cwiki.apache.org/confluence/display/WW/S2-061
- JVN#43969166 third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2021.html
- http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
- https://security.netapp.com/advisory/ntap-20210115-0005/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- [oss-security] 20220412 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html