CVE-2016-3081 – High Severity Command Injection in Apache Struts (CISA KEV)

Key takeaways

• CVE-2016-3081 is a High severity command injection flaw in Apache Struts with CISA KEV status.
• Affected versions: Struts 2.3.19‑2.3.28 when Dynamic Method Invocation (DMI) is enabled.
• Impact: Remote code execution (RCE) leading to full compromise of confidentiality, integrity, and availability.
• Immediate action: Upgrade to patched versions (2.3.20.3, 2.3.24.3, or 2.3.28.1) or disable DMI; apply vendor mitigations.
• For detailed exploit activity and timelines, see the VulnSocial CVE page.

Overview

CVE-2016-3081 is a critical command injection vulnerability in the Apache Struts 2 framework. The flaw resides in the Dynamic Method Invocation (DMI) feature, which, when enabled, allows attackers to craft OGNL expressions using the method: prefix to execute arbitrary system commands on the underlying server. Exploitation requires no authentication and can lead to full host compromise.

Technical details

When DMI is enabled (struts.enable.DynamicMethodInvocation=true), Struts processes action mappings that contain the method: prefix. An attacker can supply a malicious OGNL expression (e.g., method:#_memberAccess[@java.lang.Runtime@getRuntime().exec('calc')]) that bypasses security checks and executes arbitrary code via chained expressions. The vulnerability affects Struts versions 2.3.19 through 2.3.28, inclusive of several sub‑ranges, when DMI is turned on.

Severity & impact

The vulnerability impacts Confidentiality, Integrity, and Availability (as reflected in the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants remote attackers the ability to run arbitrary commands with the privileges of the Struts application process.

Affected products

• Apache Struts versions 2.3.19‑2.3.20.2, 2.3.21‑2.3.24.1, and 2.3.25‑2.3.28 (when DMI enabled).
• Various downstream products that embed Struts, including Huawei offerings (e.g., Agile Controller‑Campus, FireHunter6000, OceanStor series) and Oracle applications (FlexCube Private Banking, Siebel e‑Billing, etc.).

For the full list of affected products and versions, see the VulnSocial CVE page.

Actionable insights / What to do

• Verify whether Dynamic Method Invocation is enabled in your Struts configuration.
• Monitor web server and application logs for requests containing the method: prefix or unusual OGNL patterns.
• Prioritize patching for internet‑facing Struts instances; internal systems should also be updated due to lateral movement risk.
• Consider deploying a WAF rule that blocks OGNL expressions with method: or suspicious chained expressions.
• Follow CISA’s BOD 26‑04 guidance for prioritizing security updates based on risk.

Remediation & Mitigation

1. Check DMI setting – Look for struts.enable.DynamicMethodInvocation=true in struts.properties or equivalent configuration.
2. Disable DMI – If immediate upgrade is not possible, set struts.enable.DynamicMethodInvocation=false and restart the application.
3. Apply patches – Upgrade to one of the fixed releases:
   • Apache Struts 2.3.20.3
   • Apache Struts 2.3.24.3
   • Apache Struts 2.3.28.1
4. Vendor advisories – Consult the relevant references for Huawei and Oracle product‑specific patches (see References section).
5. Network controls – Restrict access to Struts applications via firewalls or VPNs; implement ingress filtering to block known exploit patterns.
6. Log analysis – Review access and error logs for strings like method: or OGNL; correlate with exploit DB signatures (e.g., Exploit‑DB 39756, Rapid7 modules).
7. Validate compliance – Ensure actions align with CISA KEV due date (2026‑10‑11) and BOD 26‑04 requirements.

References

• https://struts.apache.org/docs/s2-032.html
• http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec
• http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
• http://www.securityfocus.com/bid/87327
• http://www.securityfocus.com/bid/91787
• http://www.securitytracker.com/id/1035665
• https://www.exploit-db.com/exploits/39756/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081
• https://vulnsocial.com/cve/CVE-2016-3081

Bottom line: CVE-2016-3081 remains a high‑risk, actively exploited command injection flaw in Apache Struts. Immediate mitigation—disabling DMI or applying the cited patches—is essential to prevent remote compromise. Keep an eye on exploit telemetry via the VulnSocial CVE page for evolving threat indicators.

#CVE20163081 #ApacheStruts #CommandInjection #CISAKEV #RCE #VulnManagement