Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Multiple Vulnerabilities in Apache Struts2 Core 7.4.0 and Below

1 source · 4 articlesFirst reported Updated ()2
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Multiple issues in Apache Struts2 Core versions 7.4.0 and below allow deployment-wide cross-origin bypass, integer overflows, resource exceptions, and arbitrary code execution.

Reports reveal several issues in Apache Struts2 Core version 7.4.0 and below. Miskeyed exemptedPaths in interceptors exempts cross-origin protections for the entire deployment. An integer overflow causes wrap-arounds when casting to smaller types. The Spring plugin opens an ApplicationContext via try-with-resources but uses the closed resource outside the block, resulting in IllegalStateException. The OGNL sandbox can be bypassed using nested arguments that invoke reflection, allowing arbitrary code execution.

Key facts
  • Cross-origin protections exempted for entire deployment
  • Integer overflow results in wrap-arounds during type casting
  • Spring plugin uses closed ApplicationContext causing IllegalStateException
  • OGNL sandbox bypassed via nested reflection calls
  • Affects versions 7.4.0 and below
  • Input validation recommended for Struts2 Core
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
Apache
Products
Struts2 Core

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Full DisclosureFirst report

    Apache Struts2 Core cross-origin protection exemption miskeyed to deployment-wide path

    Miskeyed exemptedPaths in Struts2 Core interceptors allows bypass of cross-origin protections for entire deployment

  2. · 9d ago Full Disclosure

    Apache Struts2 Core Integer Overflow

    Apache Struts2 Core up to version 7.4.0 fails to prevent integer overflows that cause wrap-arounds on downstream casting to types smaller than BigInteger.

  3. · 9d ago Full Disclosure

    Apache Struts2 Spring Plugin opens Spring ApplicationContext outside try-with-resources

    The Spring Plugin in Apache Struts2 Core opens an ApplicationContext via try-with-resources but continues to use the closed resource, resulting in IllegalStateException.

  4. · 9d ago Full Disclosure

    Apache Struts2 Core 7.4.0 and below allows arbitrary code execution via OGNL sandbox escape

    The OGNL sandbox in Apache Struts2 Core 7.4.0 and below can be bypassed using nested arguments that invoke reflection, allowing arbitrary code execution.