Description
A Remote Code Execution vulnerability exists in Apache Struts2 Showcase app in the Struts 1 plugin example in the Struts 2.3.x series.
Remediation
Always use resource keys instead of passing a raw message to the ActionMessage as shown below, never pass a raw value directly messages.add("msg", new ActionMessage("struts1.gangsterAdded", gform.getName())); and never like this messages.add("msg", new ActionMessage("Gangster " + gform.getName() + " was added"));
References
Related Vulnerabilities
Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2017-12149)
e107 Other Vulnerability (CVE-2006-3259)
MediaWiki Resource Management Errors Vulnerability (CVE-2015-6733)
Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-7913)
PostgreSQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3167)