Apache Struts2 Remote Command Execution (S2-048)

Description
  • A Remote Code Execution vulnerability exists in Apache Struts2 Showcase app in the Struts 1 plugin example in the Struts 2.3.x series.
Remediation
  • Always use resource keys instead of passing a raw message to the ActionMessage as shown below, never pass a raw value directly messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName())); and never like this messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));
References