漏洞描述
Apache Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via for"m input beginning with a "%{" sequence and ending with a "}" character.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.guildhab.tophttps://www.guildhab.top/?p=2326↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2007-4556↗cwiki.apache.orghttps://cwiki.apache.org/confluence/display/WW/S2-001↗forums.opensymphony.comhttp://forums.opensymphony.com/ann.jspa?annID=54↗issues.apache.orghttp://issues.apache.org/struts/browse/WW-2030↗