Critical Improper Input Validation in Apache Struts 2 (CVE‑2012‑0391) Enables Remote Code Execution
What It Is
The ExceptionDelegator component in Apache Struts 2 versions prior to 2.2.3.1 fails to properly validate input data. An attacker can craft a malicious request that triggers arbitrary code execution on the vulnerable server.
Exploitability
- Listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
- Public proof‑of‑concept code has existed since the vulnerability’s disclosure in 2012.
- CVSS v3.1 base score: 9.8 (Critical).
Affected Products
- Apache Struts 2 (all releases before 2.2.3.1).
- Any web application or service that embeds the vulnerable Struts 2 libraries.
Why It Matters for Compliance & Audit Readiness
- Control‑mapping: The flaw directly undermines Access Control (AC‑3) and System and Information Integrity (SI‑2) controls in NIST CSF and ISO 27001.
- Vendor‑management: Maintaining an up‑to‑date component inventory is a core evidence point for demonstrating due diligence in third‑party risk programs.
- Continuous monitoring: Detecting exploitation attempts (e.g., anomalous request patterns to the ExceptionDelegator endpoint) provides defensible audit logs that satisfy “evidence of monitoring” requirements in SOC 2 and PCI‑DSS.
- Audit trail: Documenting the remediation (version upgrade, compensating WAF rules, verification testing) creates a clear, repeatable remediation path that auditors can trace back to the original control deficiency.
Recommended Actions
- Inventory all applications that include Apache Struts 2 and identify the exact library version.
- Upgrade any instance running a version earlier than 2.2.3.1 to the latest supported release (or apply the official security patch if upgrade is not feasible).
- Apply temporary mitigations:
- Deploy a Web Application Firewall rule that blocks the known malicious payload pattern targeting
ExceptionDelegator. - Restrict network access to Struts‑exposed endpoints to trusted sources only.
- Validate remediation by testing for the absence of the vulnerable class and confirming that crafted exploit attempts are rejected.
- Document the remediation steps, version changes, and monitoring alerts in your control‑assessment repository to maintain a defensible audit trail.
Source: CISA KEV – CVE‑2012‑0391