Remote Code Execution can be performed when using REST Plugin.
Who should read this
All Struts 2 developers and users
Impact of vulnerability
Possible Remote Code Execution
Maximum security rating
Upgrade to Struts 2.3.29.
Struts 2.3.20 - Struts Struts 188.8.131.52
Chao Jack PKAV_香草 jc1990999 at yahoo dot com
Shinsaku Nomura nomura at bitforest dot jp
It is possible to pass a malicious expression which can be used to execute arbitrary code on server side when using the REST Plugin.
Upgrade to Apache Struts version 2.3.29.
Some backward incompatibility issues are expected when upgrading to Struts 2.3.29 - it can happen that some OGNL expressions stop working because of performing disallowed arithmetic operations and assigments.
Not possible as this fix requires changes in OGNL and how Struts uses OGNL in certain aspects.