Late last year, an Apache Struts Remote Code Execution (RCE) vulnerability (CVE-2020-17530) was discovered. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language (OGNL) double evaluation of a tag's dynamic attributes may lead to RCE. Apache Struts is one of the most popular web frameworks on the internet, and is often a target by malicious threat actors due to its public facing nature. This RCE vulnerability is dependent on how a specific Apache Struts web application is configured which can make detection, defense, and risk analysis a complex task.
If you'd like to learn more about this vulnerability, you can find a proof of concept exploit for CVE-2020-17530 written in Python on the Cyborg Security GitHub account: https://github.com/CyborgSecurity/CVE-2020-17530
For more deep dives, view our latest, Threat Hunt Deep Dives: SolarWinds' Supply-Chain Compromise (Solorigate / SUNBURST Backdoor).
Share this article
All Resources