CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability

CVE-2020-17530 is a remote code execution vulnerability in Apache Struts. It stems from Forced Object-Graph Navigation Language (OGNL) evaluation performed on raw user input supplied in tag attributes. When that evaluation occurs, an attacker who can reach the vulnerable application may execute code on the server. This matters because Struts is commonly used to build Java web applications that sit on the internet or internal networks and often handle sensitive business data; successful abuse can give an attacker a foothold inside the application server.

Defenders should treat this as a high-priority issue for any environment still running Apache Struts until they have confirmed the vendor fix is applied. Specifics such as exact affected releases must be verified against the vendor advisory.

How it works

The underlying weakness is CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement. In Apache Struts, certain tag attributes can trigger OGNL expression evaluation. When those attributes receive untrusted input that is not properly sanitized or constrained, the framework may interpret attacker-controlled strings as executable OGNL. An attacker who can submit crafted requests that reach the vulnerable tags can therefore force the server to evaluate malicious expressions, leading to remote code execution under the privileges of the application process.

No public exploit mechanics beyond this class description are assumed here; teams should consult the vendor advisory for the precise conditions under which evaluation occurs and for any proof-of-concept details the vendor chooses to publish.

Am I affected? How to find it in your systems

Apache Struts is typically found in Java-based web applications, often packaged as WAR or EAR files deployed on application servers such as Tomcat, JBoss/WildFly, WebLogic, or similar containers. It may appear in custom-developed applications, older enterprise portals, or third-party products that embed the framework.

• Inventory: Search build manifests, dependency management files (Maven pom.xml, Gradle builds), and deployed library directories for struts2-core or related Struts JARs. Check application server lib directories and container images as well.
• Version and configuration check: Compare discovered Struts versions and tag usage against the ranges listed in the vendor advisory for CVE-2020-17530. Pay particular attention to applications that render user-controlled data inside Struts tags.
• Runtime discovery: Use software composition analysis, package inventories, or endpoint detection tools that flag known vulnerable libraries. Review application configuration for any custom tag libraries or interceptors that might expand the attack surface.
• Telemetry signs: Look for unusual HTTP requests containing OGNL-like syntax in parameters or headers, unexpected process spawns from the Java application server, or error logs that reference OGNL evaluation failures. Correlate with web access logs for anomalous traffic to Struts-powered endpoints. Confirm any indicators against the vendor advisory and your own baselines.

How to remediate

Patch first. Apply the updates published by the Apache Struts project exactly as directed in the vendor advisory for CVE-2020-17530. CISA’s required action is to apply updates per vendor instructions; do not rely on work-arounds as a permanent solution.

• After patching, rebuild and redeploy affected applications, then verify the new library versions are loaded at runtime.
• For this class of flaw, harden input handling: ensure user-supplied data is never placed directly into tag attributes that trigger expression evaluation, and prefer safer output-encoding practices.
• Remove or disable unused Struts components and tag libraries to shrink the attack surface.
• Re-run dependency scans and penetration tests focused on expression-language injection to confirm the fix.

If you can't patch immediately

Implement compensating controls while you schedule the vendor update.

• Network segmentation: Restrict access to the application so that only trusted clients or reverse proxies can reach Struts endpoints; block direct internet exposure where possible.
• Virtual patching / WAF: Deploy web-application firewall rules that detect and block common OGNL injection patterns in request parameters, headers, and body content. Tune rules carefully to avoid false positives and keep them updated.
• Feature reduction: If the vulnerable tag usage can be identified and temporarily disabled or rewritten without breaking critical functionality, do so.
• Heightened monitoring: Enable detailed application and web-server logging, alert on anomalous expression-like payloads, and watch for post-exploitation behaviors such as unexpected outbound connections or new processes spawned by the Java runtime. Retain logs for forensic review.

These measures reduce risk but do not eliminate it; treat them as temporary until the official update is applied.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities can lead to full application compromise and subsequent data theft or ransomware deployment, although ransomware use specifically tied to this CVE is not documented. If you have reason to believe an intrusion occurred, follow your incident-response plan: isolate affected hosts, preserve evidence, and assess what data the application could access. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or other information have already appeared in public dumps.