CVE-2006-1547
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
Description
CVE-2006-1547 is a HIGH severity denial-of-service vulnerability (CWE-749) in Apache Struts 1 before version 1.2.9 when used with BeanUtils 1.7. The vulnerability resides in the ActionForm component, which exposes a dangerous method that allows an unauthenticated remote attacker to cause a denial-of-service condition on the application server. With a CVSS 3.1 score of 7.5, the vulnerability is exploitable over the network with low complexity, requires no authentication and no user interaction, and impacts the availability of the targeted application. CISA added CVE-2006-1547 to its KEV catalog on January 21, 2022, with a remediation deadline of July 21, 2022. The EPSS score of 0.15469 (94.55th percentile) indicates significant exploitation probability given the widespread deployment of Struts-based applications.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | struts | < 1.2.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- http://issues.apache.org/bugzilla/show_bug.cgi?id=38534(Issue Tracking, Permissions Required)
- http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html(Broken Link)
- http://secunia.com/advisories/19493(Broken Link)
- http://secunia.com/advisories/20117(Broken Link)
- http://securitytracker.com/id?1015856(Broken Link, Third Party Advisory, VDB Entry)
- http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html(Broken Link, Exploit, Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/17342(Broken Link, Third Party Advisory, VDB Entry)
- http://www.vupen.com/english/advisories/2006/1205(Broken Link)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25613(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547(US Government Resource)
Weakness Type
CWE-749: Exposed Dangerous Method or Function
Exposed Dangerous Method or Function is a vulnerability class where software provides an interface (such as an API, web endpoint, or framework method) that includes functionality not intended for external access or not properly restricted to authorized users. This weakness arises when critical methods or functions become accessible to unauthorized parties, either because they were never designed for external exposure or because access restrictions were inadequately implemented. The exposed functionality may allow attackers to manipulate internal state, access sensitive data, trigger resource-intensive operations, or crash the application.
In CVE-2006-1547, the Apache Struts 1 framework's ActionForm class, when combined with BeanUtils 1.7, exposes an internal method through the form bean's property mapping mechanism. The BeanUtils library's introspection capabilities allow external HTTP request parameters to invoke methods on the ActionForm object that were intended to be internal-only. By crafting HTTP requests with specific parameter names that map to dangerous internal methods, an attacker can trigger operations that consume excessive resources or cause the application to enter an irrecoverable error state, resulting in a denial of service. The vulnerability highlights the risks of reflection-based parameter binding in web frameworks, where the framework automatically maps user input to object properties without adequately restricting which methods are accessible. Learn more about Exposed Dangerous Method or Function (CWE-749)
Impact Analysis
CVE-2006-1547 carries a CVSS 3.1 base score of 7.5 (HIGH) with a focused impact on application availability.
Confidentiality (None): The vulnerability does not directly enable data disclosure. The attack is focused on disrupting application availability rather than extracting information. The exposed method causes a denial-of-service condition without providing the attacker with access to application data, user credentials, or internal system information.
Integrity (None): The vulnerability does not allow modification of application data or configuration. The attack leverages the exposed method to disrupt operations but does not provide the attacker with the ability to alter database records, modify application logic, or tamper with stored data. The impact is limited to availability disruption.
Availability (High): The primary impact of CVE-2006-1547 is on availability. By sending specially crafted HTTP requests that invoke the exposed dangerous method, an attacker can cause the Struts application to crash or become unresponsive. This affects all users of the application, potentially disrupting business-critical operations that depend on the Struts-based web application. Depending on the deployment architecture, the denial-of-service may require manual intervention to restart the application server.
Scope (Unchanged): The vulnerability's impact is contained within the affected Struts application and its hosting infrastructure. However, if the Struts application is a critical component of a larger system (such as an enterprise portal or customer-facing application), the downstream business impact can be significant. The EPSS score of 0.15469 (94.55th percentile) indicates that exploitation is well above average, reflecting the historical targeting of Struts vulnerabilities by threat actors.
Exploit Maturity
Active Exploitation: CVE-2006-1547 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on January 21, 2022, with a federal remediation deadline of July 21, 2022. Despite being a relatively old vulnerability (disclosed in 2006), its continued presence in the KEV catalog reflects ongoing risk from unpatched legacy Struts 1 applications.
Ransomware Association: The CISA KEV catalog does not associate CVE-2006-1547 with known ransomware campaigns. As a denial-of-service vulnerability, it is more commonly exploited for disruption rather than as an initial access vector for ransomware.
Public Exploits: The Apache Struts 1 release notes for version 1.2.9 document the vulnerability and the fix. Due to the age of this vulnerability and the widespread knowledge of Struts parameter binding issues, exploitation techniques are well-documented in the security community and readily available.
EPSS Context: The EPSS score of 0.15469 (94.55th percentile) places this vulnerability in the top 5.5% of all CVEs for exploitation probability. While lower than the critical RCE vulnerabilities, this is still a significant score that reflects active scanning and exploitation of legacy Struts 1 applications.
KEV Deadline: The CISA remediation deadline was July 21, 2022. Organizations running legacy Struts 1 applications should upgrade or migrate to supported frameworks as an urgent priority.
Remediation
-
Upgrade Apache Struts 1 to version 1.2.9 or later. The vulnerability is fixed in Struts 1.2.9, which addresses the exposed method issue in ActionForm. However, note that Apache Struts 1 reached end-of-life in 2013 and no longer receives security updates. Upgrading within Struts 1 should be considered a temporary mitigation only.
-
Migrate to a supported web framework. Apache Struts 1 has been end-of-life since 2013 and carries numerous unpatched vulnerabilities beyond CVE-2006-1547. Plan and execute a migration to a currently supported framework such as Apache Struts 2 (with current patches), Spring MVC, Jakarta EE, or another modern web framework that receives active security maintenance.
-
Update BeanUtils to a secure version. The vulnerability is specifically triggered in combination with BeanUtils 1.7. Update Apache Commons BeanUtils to the latest version, which includes property access restrictions that prevent the exploitation of reflection-based parameter binding vulnerabilities.
-
Implement input validation at the web application firewall level. Deploy WAF rules to filter and block HTTP requests containing parameter names that map to dangerous internal methods of ActionForm and BeanUtils. This provides defense-in-depth while migration to a supported framework is underway.
-
Restrict network access to the vulnerable application. If the Struts 1 application cannot be immediately upgraded or migrated, limit access to trusted networks and users only. Remove the application from public internet exposure where possible, and implement rate limiting to reduce the impact of denial-of-service attempts.
-
Conduct a comprehensive legacy application audit. CVE-2006-1547 is likely one of many vulnerabilities in end-of-life Struts 1 deployments. Conduct a thorough security assessment of all legacy web applications to identify and prioritize remediation of the highest-risk components.
Technical Details
CVE-2006-1547 is a denial-of-service vulnerability in Apache Struts 1 before version 1.2.9, specifically triggered when the framework uses BeanUtils 1.7 for form bean property population. The Struts framework uses Apache Commons BeanUtils to automatically map HTTP request parameters to properties of ActionForm objects through Java reflection and introspection.
The vulnerability arises because BeanUtils 1.7's property population mechanism does not adequately restrict which methods can be invoked through parameter name mapping. The BeanUtils introspection engine discovers all public methods on the ActionForm class (and its parent classes), making them accessible through HTTP request parameters. By crafting request parameter names that correspond to internal method names, an attacker can invoke operations that were never intended to be externally accessible.
The CVSS 3.1 vector shows AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that the attack is network-based, requires no authentication, and impacts only availability. The attack complexity is low because the parameter names needed to trigger the vulnerability can be determined through analysis of the Struts and BeanUtils APIs.
The root cause is a design limitation in the reflection-based parameter binding approach used by Struts 1 and BeanUtils. By treating all public methods as potentially settable properties, the framework creates an implicit attack surface that grows with each method added to the ActionForm class hierarchy. The fix in Struts 1.2.9 introduced property access restrictions to prevent external invocation of methods that are not intended to be form properties.
Frequently Asked Questions
What is CVE-2006-1547?
CVE-2006-1547 is a denial-of-service vulnerability in Apache Struts 1 before version 1.2.9 when used with BeanUtils 1.7. The vulnerability exists in the ActionForm component, which exposes a dangerous internal method through the framework's reflection-based parameter binding mechanism. An unauthenticated remote attacker can send specially crafted HTTP requests to crash or disrupt the Struts application.
Which applications are affected by CVE-2006-1547?
Any web application built on Apache Struts 1 before version 1.2.9 that uses BeanUtils 1.7 for form bean population is affected. This includes a wide range of enterprise Java web applications deployed between 2001 and the mid-2010s. Since Struts 1 reached end-of-life in 2013, affected applications are running on an unsupported framework with no further security patches available.
How do I fix CVE-2006-1547?
The immediate fix is to upgrade to Apache Struts 1.2.9 or later, which restricts the exposed method. However, since Struts 1 is end-of-life, the recommended long-term solution is to migrate to a supported web framework such as Spring MVC, Struts 2 (with current patches), or Jakarta EE. In the interim, deploy WAF rules to block exploitation attempts and restrict network access to the vulnerable application.
How severe is CVE-2006-1547?
CVE-2006-1547 is rated HIGH with a CVSS 3.1 score of 7.5. While it only impacts availability (not confidentiality or integrity), its EPSS score of 0.15469 (94.55th percentile) confirms significant exploitation activity. CISA has included it in the Known Exploited Vulnerabilities catalog, reflecting the ongoing risk posed by unpatched legacy Struts 1 applications in enterprise environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.