External risk intelligence

Apache Struts Dynamic Method Invocation Code Execution

CVE advisoryKnown Exploit

CVE-2016-3081

Apache Struts is a widely used framework for building enterprise-grade, internet-facing web applications. Because it is deployed at the web application layer to process incoming requests, it is commonly exposed to public networks as an API or web endpoint, making it a frequent target for remote access in production environments.

Apache Struts

2.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0.102.0.112.0.11.12.0.11.22.0.122.0.132.0.142.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.82.1.8.12....

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Struts, a framework for building web applications, could allow attackers to execute arbitrary code by exploiting a feature called Dynamic Method Invocation. This matters because it affects widely used internet-facing applications. The main concern is confirming relevance and exposure.

Remote code execution in web applications.
Widely used framework, often internet-facing.
Confirm relevance and exposure for web applications.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a web application using a vulnerable version of Apache Struts. If Dynamic Method Invocation is enabled, the application may process this request, allowing the attacker to execute arbitrary code on the server.

No special access required.
Malicious input via method prefix.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

When Dynamic Method Invocation is enabled, remote attackers could execute arbitrary code through specific method prefixes. This means an attacker could potentially compromise the affected system's behavior and integrity.

System commands and configuration.
Via method: prefix on requests.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world impact of this vulnerability necessitates a coordinated response from application owners, infrastructure teams, and potentially vendor management. The initial crucial step is to identify all instances of the affected Apache Struts technology, assess their internet exposure and business criticality, and pinpoint the accountable system owners. This information will then inform a risk-based remediation plan, considering maintenance windows and vendor coordination.

Application owners should lead remediation efforts.
Verify external accessibility and business criticality first.
Plan and schedule updates based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Struts and why is it used?

Apache Struts is a popular, open-source framework used by developers to build enterprise-grade web applications. It provides the underlying structure for processing incoming web requests and managing application flow. Because it handles interactions between users and the server, it is commonly integrated into the core architecture of many business web portals and APIs.

What is the vulnerability in CVE-2016-3081?

This vulnerability is classified as Command Injection (CWE-77). In simple terms, it means the software does not properly filter user input before using it to execute commands. When specific settings are active, an attacker can supply malicious instructions disguised as normal web request parameters, tricking the server into running unintended code on the underlying system.

How does an attacker trigger this bug?

An attacker triggers this by sending a specially crafted request to an application that has the 'Dynamic Method Invocation' feature enabled. The attack leverages a specific 'method:' prefix in the request to chain expressions that the server executes. If Dynamic Method Invocation is disabled in your configuration, the application will not process these malicious method prefixes, effectively neutralizing this specific trigger path.

Do I need to worry if my application is internal?

Halo Surface Signal indicates that Apache Struts is frequently deployed to process public web requests, making internet-facing instances a primary concern for remote access. While internal applications are less likely to be reached by external attackers, they remain potentially vulnerable if accessed by a compromised internal user. Always prioritize applications exposed to the public internet during your assessment.

When should I take action to address this?

You should begin by identifying every instance of Apache Struts running within your environment to determine which versions are affected. Coordinate with system owners to assess whether Dynamic Method Invocation is active on these instances. Once you have mapped your exposure and identified business-critical systems, plan a remediation update or configuration change according to your organization's risk management procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.