CVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability
Description
CVE-2012-0391 is a CRITICAL remote code execution vulnerability in Apache Struts 2 before version 2.2.3.1, caused by improper input validation (CWE-20) combined with code injection (CWE-94) in the ExceptionDelegator component. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the application server by sending specially crafted HTTP requests that exploit OGNL (Object-Graph Navigation Language) expression evaluation in error handling. With a CVSS 3.1 score of 9.8, this vulnerability requires no authentication, no user interaction, and is exploitable over the network with low complexity. CISA added CVE-2012-0391 to its KEV catalog on January 21, 2022, with a remediation deadline of July 21, 2022. The EPSS score of 0.88319 (99.49th percentile) confirms extremely high exploitation probability, reflecting the long history of Struts OGNL injection attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | struts | < 2.2.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0031.html(Broken Link, Exploit)
- http://secunia.com/advisories/47393(Vendor Advisory)
- http://struts.apache.org/2.x/docs/s2-008.html(Vendor Advisory)
- http://struts.apache.org/2.x/docs/version-notes-2311.html(Vendor Advisory)
- http://www.exploit-db.com/exploits/18329(Exploit)
- https://issues.apache.org/jira/browse/WW-3668(Vendor Advisory)
- https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt(Broken Link, Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0391(US Government Resource)
Weakness Type
CWE-20 / CWE-94: Improper Input Validation and Code Injection
CVE-2012-0391 involves two complementary weakness types. CWE-20 (Improper Input Validation) describes the failure to properly validate user input before processing, while CWE-94 (Improper Control of Generation of Code, or Code Injection) describes the ability to inject and execute arbitrary code through the application. Together, these weaknesses create a devastating attack chain where unchecked input reaches an expression evaluation engine that executes attacker-supplied code.
In Apache Struts 2, the framework uses OGNL (Object-Graph Navigation Language) as its expression language for value stack operations, type conversion, and data binding. The ExceptionDelegator component handles exceptions that occur during request processing, and in vulnerable versions, error messages containing user-supplied input are evaluated as OGNL expressions. An attacker crafts HTTP request parameters designed to trigger validation exceptions, with the parameter values containing malicious OGNL expressions. When the ExceptionDelegator processes the exception, it evaluates the error message as an OGNL expression, executing the attacker's code in the context of the application server. This is one of the earliest and most impactful OGNL injection vulnerabilities in Struts 2, a pattern that would be repeated in numerous subsequent CVEs. Learn more about Improper Input Validation (CWE-20)
Impact Analysis
CVE-2012-0391 has a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the devastating impact of unauthenticated remote code execution on a widely deployed web framework.
Confidentiality (High): Successful OGNL injection allows the attacker to execute arbitrary Java code and operating system commands on the application server. This provides full access to application source code, database connection strings, API credentials, user data, session tokens, and any files readable by the application server process. In enterprise environments, Struts applications often connect to backend databases containing sensitive business data, customer records, and financial information.
Integrity (High): Code execution on the application server enables the attacker to modify application logic, alter database records, inject malicious content into web pages, deploy web shells for persistent access, and modify server configurations. The attacker can install backdoors, create administrative accounts, and establish persistence mechanisms that survive application restarts.
Availability (High): The attacker can terminate the application server, consume system resources, corrupt application data, or deploy ransomware. OGNL injection attacks have been used in destructive campaigns targeting enterprise applications, sometimes resulting in complete infrastructure compromise and prolonged outages.
Scope (Unchanged): While the scope is technically unchanged, code execution on a Struts application server typically provides a foothold for lateral movement to database servers, internal APIs, and other backend systems. The EPSS score of 0.88319 (99.49th percentile) confirms that this vulnerability is among the most heavily exploited CVEs, consistent with the long history of Struts-based attacks.
Exploit Maturity
Active Exploitation: CVE-2012-0391 is actively exploited and has been a target for threat actors since its disclosure. CISA added it to the KEV catalog on January 21, 2022, confirming continued exploitation. Struts 2 OGNL injection vulnerabilities have been involved in some of the most high-profile breaches in history, and CVE-2012-0391 is part of this attack pattern.
Ransomware Association: The CISA KEV catalog does not directly associate CVE-2012-0391 with ransomware campaigns. However, remote code execution on enterprise application servers is a high-value initial access vector for ransomware operators.
Public Exploits: Public exploit code is available from multiple sources, including archives on Neohapsis. The official Apache Struts security bulletin S2-008 documents the vulnerability. Metasploit and other exploitation frameworks include modules for this vulnerability.
EPSS Context: The EPSS score of 0.88319 (99.49th percentile) places this vulnerability in the top 0.5% of all CVEs for exploitation probability. This exceptionally high score reflects the combination of public exploit availability, widespread Struts 2 deployment, and the devastating impact of successful exploitation.
KEV Deadline: The CISA remediation deadline was July 21, 2022. Organizations running Struts 2 versions prior to 2.2.3.1 must upgrade immediately.
Remediation
-
Upgrade Apache Struts 2 to version 2.2.3.1 or later. The ExceptionDelegator OGNL injection vulnerability is fixed in Struts 2.2.3.1 as documented in security bulletin S2-008. Apply this update to eliminate the vulnerability. Ideally, upgrade to the latest Struts 2 release to benefit from all subsequent security fixes.
-
Apply all Struts 2 security bulletins comprehensively. CVE-2012-0391 is one of many OGNL injection vulnerabilities in Struts 2's history. Review all Apache Struts security bulletins (S2-001 through the latest) and ensure your version addresses all known vulnerabilities. The Struts 2 security bulletin page provides a comprehensive list.
-
Disable dynamic method invocation and OGNL evaluation where possible. Configure Struts 2 to restrict OGNL expression evaluation. Set
struts.enable.DynamicMethodInvocationtofalseand implement strict OGNL expression allowlists to limit the scope of expression evaluation to only necessary operations. -
Deploy a web application firewall with OGNL injection detection. Configure WAF rules to detect and block HTTP requests containing OGNL injection patterns such as
%{,${,#,@, and common OGNL method invocations. This provides defense-in-depth while patches are applied. -
Implement network segmentation for application servers. Isolate Struts application servers in dedicated network segments with strict access controls. Limit outbound connectivity from application servers to prevent data exfiltration and command-and-control communication in the event of compromise.
-
Conduct a thorough security review of all Struts deployments. Inventory all Apache Struts 2 installations across the organization, determine their versions, and prioritize patching based on exposure and criticality. Consider migrating high-risk applications to alternative frameworks if keeping Struts current proves challenging.
Technical Details
CVE-2012-0391 is an OGNL injection vulnerability in the ExceptionDelegator component of Apache Struts 2 before version 2.2.3.1. OGNL (Object-Graph Navigation Language) is a powerful expression language used throughout Struts 2 for data binding, type conversion, and value stack operations. The vulnerability exists because user-controlled input that triggers validation exceptions is subsequently evaluated as an OGNL expression during exception handling.
The exploitation technique involves sending HTTP requests with carefully crafted parameter values that are designed to trigger a type conversion or validation exception. For example, submitting a string value where an integer is expected causes a conversion exception. The error message generated by the ExceptionDelegator includes the original user-supplied value, and this error message is processed through Struts 2's tag library, which evaluates OGNL expressions embedded in the message text.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation is network-based, requires no authentication, and achieves full system compromise. The OGNL expression evaluation engine in Struts 2 has access to the Java runtime environment, allowing expressions like #rt = @java.lang.Runtime@getRuntime(), #rt.exec('command') to execute arbitrary operating system commands.
The root cause is the failure to sanitize user input before it enters the OGNL expression evaluation pipeline. The ExceptionDelegator processes exception messages through the same expression evaluation mechanism used for legitimate template rendering, without distinguishing between trusted template expressions and untrusted user input. This OGNL injection pattern (user input reaching OGNL evaluation through various pathways) became the defining vulnerability class for Apache Struts 2, recurring in CVE-2013-2251, CVE-2017-5638, CVE-2017-9805, and many others.
Frequently Asked Questions
What is CVE-2012-0391?
CVE-2012-0391 is a critical remote code execution vulnerability in Apache Struts 2 before version 2.2.3.1. It exploits OGNL (Object-Graph Navigation Language) expression injection through the ExceptionDelegator component, allowing an unauthenticated remote attacker to execute arbitrary Java code and operating system commands on the application server by sending specially crafted HTTP requests that trigger validation exceptions with embedded OGNL payloads.
Which applications are affected by CVE-2012-0391?
Any web application built on Apache Struts 2 before version 2.2.3.1 is potentially affected. Struts 2 was one of the most widely used Java web frameworks in enterprise environments, powering banking portals, government services, e-commerce platforms, and internal business applications. The ExceptionDelegator component is part of the core framework and is enabled by default.
How do I fix CVE-2012-0391?
Upgrade Apache Struts 2 to version 2.2.3.1 or later, which fixes the OGNL injection in the ExceptionDelegator component. Review and apply all subsequent Struts 2 security bulletins to address the full range of OGNL injection vulnerabilities. Deploy WAF rules to detect OGNL injection patterns and consider migrating to an alternative framework if maintaining current Struts patches is challenging.
How severe is CVE-2012-0391?
CVE-2012-0391 is rated CRITICAL with a CVSS 3.1 score of 9.8. Its EPSS score of 0.88319 (99.49th percentile) places it among the most actively exploited vulnerabilities. Struts 2 OGNL injection vulnerabilities have been responsible for some of the most devastating breaches in computing history, including the 2017 Equifax breach (which used the later CVE-2017-5638 but exploited the same fundamental OGNL injection pattern). CISA includes CVE-2012-0391 in the Known Exploited Vulnerabilities catalog.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.