The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 22.214.171.124 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
Struts 2.0.0 - Struts 2.3.15
- Developers should immediately upgrade to Struts 126.96.36.199
- WordPress Plugin VaultPress Remote Code Execution (1.9.0)
- Drupal Core 8.5.x Remote Code Execution (8.5.0 - 8.5.2)
- WordPress Plugin Shortcodes Ultimate Remote Code Execution (5.0.0)
- WordPress Plugin NextGEN Gallery-WordPress Gallery Remote Code Execution (2.1.59)
- Apache Struts2 Remote Command Execution (S2-052)