Home > Security Bulletins > S2-040 |

Apache Struts 2 Documentation
S2-040
Edit Page Browse Space Add Page Add News

## Summary

Input validation bypass using existing default action method.

Who should read this | All Struts 2 developers and users
Impact of vulnerability | Possible manipulation of return result and bypassing validation
Maximum security rating | Medium
Recommendation | Upgrade to Struts 2.3.29.
Affected Software | Struts 2.3.20 - Struts Struts 2.3.28.1
Reporter | Takeshi Terada websec02 dot g02 at gmail.com
CVE Identifier | CVE-2016-4431

## Problem

Using existing default method it can be possible to bypass internal security mechanism and manipulate return string which can leads to redirecting user to unvalidated location.

## Solution

Upgrade to Apache Struts version 2.3.29.

## Backward compatibility

Some backward incompatibility issues are expected when upgrading to Struts 2.3.29 - it can happen that some OGNL expressions stop working because of performing disallowed arithmetic operations and assignments.

## Workaround

You can try to use more restrictive RegEx used to clean up action names as below:

    <constant name="struts.allowed.action.names" value="[a-zA-Z]*" />

Please adjust the RegEx to your action naming pattern, it should be as narrowed as possible.