Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks

What happened?

Four security flaws described in the supplied Apache Struts advisories could expose affected applications to remote code execution, denial-of- service, and unintended data disclosure. Recommended fixes include Struts 7.4.0 or later, or Struts 6.12.0 or later for organizations using the 6.x maintenance line. The vulnerabilities affect different framework components, so exposure depends on application configuration and functionality. Three issues carry a Moderate security rating, while an unrestricted request body issue in the REST plugin is rated Important.

Key details

• Four distinct Apache Struts flaws can enable remote code execution, denial‑of‑service, or unintended data disclosure in vulnerable applications.
• An OGNL injection in the legacy RESTful action mapper allows crafted requests to execute code on the server.
• A crafted request can inject an OGNL expression that may lead to remote code execution when the mapper is used.
• Unauthenticated attackers can use sustained low‑volume traffic to consume server CPU and outbound network capacity.
• The REST plugin can read request bodies without size limits, so an oversized payload can exhaust heap memory.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.