CVE-2012-0391

Apache Struts 2 versions before 2.2.3.1 contain an improper input validation flaw (CWE-20) in the ExceptionDelegator component, which handles exception processing for the framework: crafted user-supplied input reaches the exception-handling path and is evaluated as an OGNL expression, allowing remote code execution. An attacker triggers it simply by sending maliciously crafted request parameters to an affected web application, with no authentication required. Successful exploitation lets the attacker execute arbitrary commands or code with the privileges of the application server hosting the Struts-based application. Any web application built on an affected Struts 2 release is exposed, regardless of industry or hosting model. The flaw is being exploited in the wild - CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-21, and its high EPSS (75.6%, 99th percentile) indicates substantial near-term exploitation risk.

What to do: Upgrade any application built on Apache Struts 2 to version 2.2.3.1 or later, per CISA's required action to apply vendor updates. Because Struts is typically embedded inside applications, inventory which webapps depend on the framework instead of only checking standalone installations, and monitor web server logs for exploit attempts. If immediate patching is not possible, prioritize internet-facing applications and consider filtering or restricting suspicious request parameters as an interim measure.