A pre-authentication remote code execution vulnerability has been disclosed in Apache Struts, affecting versions 2.5.0-2.5.33 and 6.0.0-6.0.2. The flaw is a Java deserialization issue reachable via the OGNL expression evaluator when handling specific multipart form requests.

Technical Summary

The vulnerability allows an attacker to craft a multipart HTTP request containing a serialised Java object in the Content-Type header. The Struts framework's multipart parser passes this value to the OGNL evaluator before authentication or input validation occurs, resulting in arbitrary code execution under the web application's process privilege.

CVSS Score

CVSS v3.1: 9.8 (Critical) - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patch Available

Apache Struts 2.5.34 and 6.0.3 have been released and address this vulnerability. Upgrade immediately.

Mitigations

  • Deploy WAF rules to block malformed multipart Content-Type values
  • Ensure Struts is not exposed to the public internet without authentication layers
  • Review web server logs for requests with unexpected characters in Content-Type headers