Company
Date Published
Author
Detectify
Word count
388
Language
-
Hacker News points
None

Summary

Apache Struts is a widely used Java-based web application framework, particularly in enterprise settings, with a notable history of security vulnerabilities. A search on MITRE reveals numerous Common Vulnerabilities and Exposures (CVEs) related to Apache Struts, many of which involve OGNL (Object-Graph Navigation Language) expression injection, akin to Server Side Template Injection attacks. The framework's security challenges were highlighted by the infamous Equifax breach, which exploited CVE-2017-5638. Apart from OGNL vulnerabilities, Apache Struts also suffers from deserialization vulnerabilities, a known issue in Java due to its potential to allow execution of arbitrary code. Detectify offers testing services to identify OGNL expression injections and other known issues in Apache Struts, providing a tool for organizations to secure their applications against these vulnerabilities.