Apache Struts 2 Double OGNL Evaluation Remote Code Execution Vulnerability (CVE-2020-17530, S2-061) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTApache Struts framework versions 2.0.0 through 2.5.25
Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes
Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache Struts to version 2.5.26 or higher. For Maven-based projects, update the struts2-core dependency in your pom.xml file:
<!-- Update struts2-core dependency in pom.xml -->
<dependency>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-core</artifactId>
<version>2.5.26</version>
</dependency>2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, ensure that no raw user input is passed directly into Struts tag attributes. Additionally, deploy Web Application Firewall (WAF) rules to block OGNL injection patterns.
# Nginx configuration to block potential OGNL injection payloads
server {
listen 80;
server_name target-app.local;
location / {
# Block OGNL syntax patterns (%{ or ${) in URI and Request Body
if ($query_string ~* '(%25%7B|%24%7B|\%\{|\$\{)') {
return 403;
}
if ($request_body ~* '(%25%7B|%24%7B|\%\{|\$\{)') {
return 403;
}
proxy_pass http://tomcat_backend;
}
}3. Log Audit & IoC Verification Commands
Use the following commands to identify vulnerable Struts 2 libraries and scan web server access logs for potential exploitation attempts.
# 1. Find vulnerable Struts 2 jar files in the system
find / -name 'struts2-core-*.jar' 2>/dev/null
# 2. Scan access logs for common OGNL injection keywords
grep -Ei '(#context|memberAccess|ProcessBuilder|Runtime\.getRuntime)' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-17530, S2-061) resides in the Object-Graph Navigation Language (OGNL) evaluation engine of the Apache Struts 2 framework. When Struts 2 processes raw user input within specific tag attributes, it performs a forced double evaluation of the input. Because the input is evaluated twice, an attacker can bypass the initial sanitization and force the OGNL engine to execute arbitrary Java expressions. This is a bypass of the previous S2-059 (CVE-2019-0230) patch.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious payload containing OGNL expressions (e.g., %{...}) and submits it via HTTP request parameters or form fields. When the Struts 2 tag library renders the page, the attribute first resolves the user input, and then evaluates the resolved string a second time as an OGNL expression. By leveraging this double evaluation, the attacker can access restricted Java classes such as java.lang.Runtime or java.lang.ProcessBuilder, bypass the Struts sandbox, and execute arbitrary operating system commands under the privileges of the web server process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild. Successful exploitation grants unauthenticated attackers complete control over the target application server. This can lead to data exfiltration, lateral movement within the internal network, deployment of ransomware, and complete compromise of the enterprise infrastructure.
Official Vendor Advisories & References
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Frequently Asked SecOps Questions (CVE-2020-17530)
FAQQ1. How critical is CVE-2020-17530 and is it actively exploited in the wild?
CVE-2020-17530 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 96.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-17530?
Primary impacted vendors include apache across struts. Scope summary: Apache Struts versions 2.0.0 to 2.5.25 (S2-061)
Q3. What temporary mitigations or workarounds exist for CVE-2020-17530 before patching?
[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-17530
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.