Remote Code Execution Vulnerability in Apache Struts 2 – Patch Now
NJCCIC Advisory
Original Release Date: 12/30/2020
Summary
A critical vulnerability, tracked as CVE-2020-17530, exists in Apache Struts 2 versions 2.0.0-2.5.25 that could allow a remote threat actor to execute code and degrade security on the affected system when a forced OGNL evaluation is evaluated on raw user input tag attributes. The exploitation of past Apache Struts vulnerabilities has resulted in cyberattacks with significant impacts, including the targeting of remote code execution vulnerability CVE-2018-11776, which was quickly weaponized by threat actors.
Recommendations
The NJCCIC recommends Apache Struts 2 administrators prioritize upgrading to version 2.5.26 after appropriate testing. Additional details can be found on the Apache Struts website.
The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.
View our Privacy Policy here.
View our Site Index here.