CVE-2020-17530

Apache Struts: Remote Code Execution

As of , CVE-2020-17530 in Apache Struts is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 3 November 2021
US federal deadline
3 May 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.96Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
1 Metasploit module
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

CISA's description

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

The CVE record's description, from apache

CVE published
11 December 2020
Assigned by
apache
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Apache Struts 2 Forced Multi OGNL Evaluationexploit module, rank excellent

Struts: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2013-2251Improper Input ValidationApache StrutsPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2017-5638Remote Code ExecutionApache StrutsPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2018-11776Remote Code ExecutionApache StrutsPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
CVE-2017-9805Deserialization of Untrusted DataApache StrutsPatch this weekMetasploit module; EPSS 0.990.99

Read further