CVE-2016-3081 (Apache Struts security bulletin S2-032) is a remote code execution vulnerability (CWE-77, command injection) in the Apache Struts 2 web application framework. When Dynamic Method Invocation is enabled, an unauthenticated remote attacker can send a request using the method: prefix to run arbitrary code on the application server. Public exploits have existed since 2016, including Metasploit modules and Exploit-DB entry 39756.

The following Apache Struts 2 versions are affected where Dynamic Method Invocation is enabled:

• Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3
• NVD also lists many earlier Struts 2.0.x to 2.3.x releases, which are end of life and should be treated as vulnerable

Not affected / patched version:

• Struts 2.3.20.3, 2.3.24.3 or 2.3.28.1. Because these are very old branches, upgrade to the current supported Struts 6 or 7 release rather than staying on a patched 2.3 build

Successful exploitation may allow attackers to:

• Run arbitrary commands on the application server with the privileges of the web application, without credentials
• Steal data and credentials held by the application, install web shells or malware, and use the server as a foothold into the internal network
• Be hit by automated mass scanning, since exploits are public and widely used

CERTVU recommends the following:

1. Upgrade Struts

   Move to a current supported Struts release. As a minimum, apply 2.3.20.3, 2.3.24.3 or 2.3.28.1, and update any commercial product that bundles Struts using the vendor's own patches.

2. Disable Dynamic Method Invocation

3. Find every Struts application

4. Add network protection

5. Hunt for compromise

   Search web logs for requests with the method: parameter, and check application servers for unexpected processes, files and outbound connections. Report suspected compromise to CERTVU.