Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below attempt to prevent arbitrary code execution via Object-Graph Navigation
Language (OGNL) through several different mechanisms but only in a cursory fashion -- the libraries only guard against
immediate calls evaluated by the OGNL engine via `SecurityMemberAccess`, but an allowed call that, instead, accepts
nested arguments and, itself, invokes reflection internally executes outside of the...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 Core 7.4.0 and below performs session token comparisons cryptographically insecure early-exit
comparison functions (e.g., `!=`, `memcmp`, byte-by-byte loops with `break`) that return as soon as the first
mismatched byte is encountered. The execution time of the comparison is therefore proportional to the number of
leading bytes that match, creating a measurable timing side-channel. Importantly, this...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 Spring Plugin opens a Spring `ApplicationContex` via a try-with-resources block and, outside of said
block, then continues to use the closed resource, resulting in an uncaught `IllegalStateException`. This particular
issue prevents proper functionality and indicates poor code quality and code review standards and processes, while not
being, itself, otherwise excessively meaningful for a production environment...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below fails to properly prevent integer overflows, causing wrap-arounds and other
issues on a downstream forced casting into types smaller than `BigInteger`. Importantly, this finding underscores why
all applications using Struts and other such platforms should perform their own input validation checks and not blindly
assume that the upstream Struts2 code has done as such, but the finding also...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
Apache Struts2 Core version 7.4.0 and below's `FetchMetadataInterceptor`, `CoepInterceptor`, and `CoopInterceptor` each
compare their `exemptedPaths` configuration -- a per-interceptor-reference, administrator-supplied set of paths
intended to exempt specific actions from the corresponding cross-origin protection -- against
`HttpServletRequest.getContextPath()`. `getContextPath()` is fixed for the entire deployed web...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 REST Plugin's (version 7.4.0 and below) `ContentTypeInterceptor.intercept(ActionInvocation)` only
deserialises a request body and enforces the `struts.rest.content.maxLength` bound when
`HttpServletRequest#getContentLength()` returns a positive value. `getContentLength()` returns `-1` whenever the
`Content-Length` header is absent, which normal and appropriate for any Hypertext Transfer Protocol (HTTP)...

Posted by Daniel Owens via Fulldisclosure on Nov 01

Description
The Apache Struts2 REST Plugin's `DefaultContentTypeHandlerManager.getHandlerForResponse(HttpServletRequest,
HttpServletResponse)` splits the `Accept` header on commas and passes each resulting token directly to
`findHandler(String)` without trimming leading or trailing whitespace. `findHandler(String)` only retries a trimmed
lookup when a token contains a semicolon (`;`), so a token that merely carries a leading space has no...

Posted by Daniel Owens via Fulldisclosure on Nov 01

As of the current versions of the Apache Struts2 JSON Plugin (e.g., version 7.4.0 and the 7.5.0 snapshot dated 28
October 2026), attackers can bypass the element-count limit purported to protect Object deserialisation added to said
code as part of the WW-5618 and S2-072 "hardening controls". Please note that this vulnerability and the attack string
is different than the previously reported bypass against the JSON array...