CVE-2025-68493

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications. 

‍

A XML External Entity, XXE, vulnerability (CVE-2025-68493) has been identified in Apache Struts. This issue arises from missing parsing configuration, which can lead to remote code execution.

‍

Per OWASP, an XML External Entity (XXE) attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

‍

This issue affects multiple versions of Apache Struts.

‍

Details

Module Info

• Product: Apache Struts 2
• Affected packages: struts2-core
• OSS Affected versions: >=2.0.0 <=2.3.37, >=2.5.0 <=2.5.33, >=6.0.0 <6.1.1
• NES Affected versions: >=2.5.33-struts2-2.5.34 <2.5.33-struts2-2.5.39
• GitHub repository: https://github.com/apache/struts
• Package manager: Maven
• Fixed in: NES for Apache Struts Struts 2 v2.5.39

‍

Vulnerability Info

The XWork component’s XML configuration parser does not properly validate XML input, allowing external entities to be processed. This weakness can be exploited through XML External Entity (XXE) injection, potentially enabling attackers to read arbitrary files, perform server-side request forgery (SSRF), or cause denial-of-service conditions by supplying malicious XML content.

‍

Mitigation

Users of the affected components should apply one of the following mitigations:

• Upgrade to patched Apache Struts 2
• Leverage a commercial support partner like HeroDevs for post-EOL security support.
• Use a custom SAXParserFactory: set xwork.saxParserFactory=  to a custom factory class that disables external entities by default.
• Define JVM-level configuration: configure the JVM's default XML parser to disable external entities via system properties (set to empty string to block all protocols):

‍

-Djavax.xml.accessExternalDTD=""
-Djavax.xml.accessExternalSchema=""
-Djavax.xml.accessExternalStylesheet=""

‍

Credit

• ZAST.AI - https://zast.ai

‍