CVE-2021-31805: Expression Language Injection in Apache Struts
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.9987%
CWE
Published
4/13/2022
Updated
1/27/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
org.apache.struts:struts2-core | maven | >= 2.0.0, < 2.5.30 | 2.5.30 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from incomplete prevention of double OGNL evaluation in forced evaluation scenarios (%{...}). Key functions were identified through: 1) Historical context from S2-061/CVE-2020-17530
fixes in Component.java
2) Struts architecture where tag attribute processing flows through Component.findValue()
3) TextParseUtil
's role in expression interpolation 4) Advisory emphasis on forced evaluation bypassing previous mitigations. These functions represent the OGNL evaluation entry points that would appear in stack traces during exploitation attempts.