Apache Struts 2 ExceptionDelegator OGNL Injection Remote Code Execution (CVE-2012-0391, S2-008)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Struts versions prior to 2.2.3.1
Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.
Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to update the Maven dependency in your project configuration to a secure version of Apache Struts.
<!-- Update Struts 2 dependency in pom.xml -->
<dependency>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-core</artifactId>
<version>2.3.35</version> <!-- Or the latest secure LTS version -->
</dependency>2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, ensure that developer mode is disabled to prevent verbose exception handling and restrict OGNL evaluation.
<!-- Disable devMode in struts.xml to mitigate detailed exception exposure -->
<struts>
<constant name='struts.devMode' value='false' />
<constant name='struts.i18n.encoding' value='UTF-8' />
</struts>3. Log Audit & IoC Verification Commands
Use the following command to scan your application directories for vulnerable Struts 2 core libraries.
# Scan the system for vulnerable struts2-core jar files
find / -name 'struts2-core-*.jar' 2>/dev/null | while read jar_path; do
echo 'Found Struts2 library: '$jar_path
version=$(basename '$jar_path' | grep -o -E '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?')
echo 'Detected Version: '$version
doneBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (S2-008) resides in the ExceptionDelegator component of the Apache Struts 2 framework. When handling exceptions triggered by mismatched data types of properties, the application fails to properly sanitize input parameters and interprets them as OGNL (Object-Graph Navigation Language) expressions.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a request to a Struts action containing a parameter with an intentional data type mismatch (e.g., passing OGNL payload into an integer field). When the ExceptionDelegator processes the resulting type conversion exception, it evaluates the parameter value as an OGNL expression, leading to arbitrary Java code execution via reflection.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and inclusion in the CISA KEV catalog, this vulnerability poses a critical risk. Successful exploitation allows complete compromise of the underlying application server, enabling attackers to deploy web shells, exfiltrate sensitive databases, or pivot into internal networks.
Official Vendor Advisories & References
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Frequently Asked SecOps Questions (CVE-2012-0391)
FAQQ1. How critical is CVE-2012-0391 and is it actively exploited in the wild?
CVE-2012-0391 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 75.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2012-0391?
Primary impacted vendors include apache across struts. Scope summary: Apache Struts versions 2.0.0 through 2.2.3 (all versions prior to 2.2.3.1)
Q3. What temporary mitigations or workarounds exist for CVE-2012-0391 before patching?
[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2012-0391
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.