Top 10 winner

Multiple vulnerabilities in Apache Struts2 and property oriented programming with Java

A blackbox test where ?id=abc'+a+'def returned null exposed OGNL evaluation in Struts2 parameter names. The author shows the character whitelist still permits dynamic names and list indexes, giving constructor calls and arbitrary file overwrite via FileWriter, then chains single-argument constructors and setters found by regex across Apache Commons into file upload, which he calls property oriented programming.

Record

Published by

Reiners' Weblog

Date

4 January 2012

Topic

Server

In the archive

• Ranked #2 in the 2011 Top 10 Web Hacking Techniques

Related sources

• Multiple critical vulnerabilities in Apache Struts2 Advisory

Tags

• rce
• java
• struts
• gadget-chain
• injection
• filter-bypass
• file-upload
• cve
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Reiners' Weblog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.