CVE-2018-11776

Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority.

What to do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values.