OGNL Injection (Apache Struts)

Detects Apache Struts and other OGNL-using frameworks vulnerable to expression injection through request parameters.

zakirkun 304de51 2 files · 1.8 KB Updated

File contents

OGNL Injection

Overview

Object-Graph Navigation Language (OGNL) is the expression language used by Apache Struts. OGNL injection has led to some of the most severe vulnerabilities in enterprise Java applications, including the Equifax breach (CVE-2017-5638).

Attackers inject OGNL expressions via HTTP parameters, content-type headers, or form fields to execute arbitrary Java code.

Remediation

  • Keep Apache Struts updated to latest version
  • Use strict validation for all HTTP parameters
  • Consider migrating from Struts to a safer framework
  • Enable Struts security workarounds as documented in advisories

zakirkun/ice-tea/tree/main/skills/injection/ognl-injection commit 304de51178

Frequently asked questions

npx skillmds@latest add zakirkun/ognl-injection-apache-struts