Summary
Dynamic Method Invocation disabled by default
Who should read this |
All Struts 2 developers and users |
---|---|
Impact of vulnerability |
Dynamic method executions |
Maximum security rating |
Important |
Recommendation |
Developers should immediately upgrade to Struts 2.3.15.2 |
Affected Software |
Struts 2.0.0 - Struts 2.3.15.1 |
Reporter |
|
CVE Identifier |
Problem
Dynamic Method Invocation is a know vulnerable mechanism, but till now it was enabled by default with warning that users should switch it off if possible.
Solution
In Struts 2.3.15.2 the Dynamic Method Invocation is to false by default. Another option is to set struts.enable.DynamicMethodInvocation to false in struts.xml
<constant name="struts.enable.DynamicMethodInvocation" value="false"/>
Backward Compatibility
Disabling Dynamic Method Invocation can break your application if it uses DMI heavily.
It is strongly recommended to upgrade to Struts 2.3.15.2, which contains the corrected Struts2-Core library.