CVE-2020-17530: Remote Code Execution in Apache Struts
Summary
CVE-2020-17530: Remote code execution in Apache Struts. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.5.26. Fixed in 2.5.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of reusable components and a Model-View-Controller (MVC) architecture to simplify the development process. The struts2-core package is a core component of Apache Struts, responsible for handling various functionalities such as request processing, tag libraries, and form handling. Unfortunately, a vulnerability has been discovered in the package that allows for remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-17530, arises from forced Object-Graph Navigation Language (OGNL) evaluation. When user input is directly evaluated in tag attributes without proper sanitization, an attacker can inject malicious OGNL expressions, leading to remote code execution. This can have severe consequences, as an attacker can execute arbitrary commands on the server, potentially compromising sensitive data, modifying or deleting files, or even taking control of the entire system.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.26
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to disable the evaluation of OGNL expressions in tag attributes. This can be achieved by modifying the Struts configuration file (struts.xml) and setting the 'struts.ognl.allowStaticMethodAccess' property to 'false'. This prevents the execution of OGNL expressions in tag attributes, mitigating the risk of remote code execution. However, it is important to note that this workaround may impact the functionality of certain features that rely on OGNL expressions.
Conclusion
The CVE-2020-17530 vulnerability in Apache Struts' struts2-core package poses a critical risk of remote code execution. It is crucial to promptly upgrade to a patched version, such as 2.5.26, to mitigate this vulnerability. Alternatively, a temporary workaround can be implemented by disabling OGNL evaluation in tag attributes. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the Model-View-Controller (MVC) architectural pattern.
The struts2-core package is a core component of Apache Struts. It handles various functionalities such as request processing, tag libraries, and form handling.
Forced OGNL evaluation refers to the evaluation of Object-Graph Navigation Language (OGNL) expressions on raw user input without proper sanitization. This can lead to the execution of arbitrary code.
The vulnerability allows for remote code execution, which means an attacker can execute arbitrary commands on the server. This can result in data breaches, unauthorized access, modification or deletion of files, and even complete system compromise.
To fix this vulnerability, you should upgrade the struts2-core package to version 2.5.26 or a subsequent release that includes the fix. This ensures that the OGNL evaluation is properly handled and prevents the execution of malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
