Description
Apache Struts 2是美国阿帕奇（Apache）基金会的一个用于开发Java EE网络应用程序的开放源代码网页应用程序架构。 Apache Struts 2.0.0版本至2.5.29版本存在安全漏洞，该漏洞源于对不受信任的用户输入在标签属性中使用强制 OGNL 评估。攻击者可利用该漏洞进行远程代码执行并导致安全性降低。
Apache Struts 2 安全漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://struts.apache.org/security/
https://www.cnblogs.com/mt0u/p/16138615.html
https://www.secrss.com/articles/24780
https://baike.baidu.com/item/struts2%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E/8277162
https://www.akamai.com/zh/blog/security-research/apache-struts-cve-exploitation-attempts
https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141
https://www.cyber.gc.ca/en/alerts-advisories/cve-2024-53677-vulnerability-impacting-apache-struts-2
https://blog.qualys.com/vulnerabilities-threat-research/2024/12/16/critical-apache-struts-file-upload-vulnerability-cve-2024-53677-risks-implications-and-enterprise-countermeasures
https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-security-vulnerability-affecting-apache-struts2-below-6-4-0
https://www.herodevs.com/blog-posts/apache-struts-vulnerabilities-in-2026-critical-cves-still-unpatched