Apache · Struts 1
Apache Struts 1 (versions before 1.2.9 paired with BeanUtils 1.7) contains a flaw in its ActionForm handling, in which a crafted parameter name exposes the public getMultipartRequestHandler method and the CommonsMultipartRequestHandler and BeanUtils elements behind it. A remote, unauthenticated attacker with no user interaction required can send a multipart/form-data request with such a parameter name to cause a denial of service.
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
First seen exploited 16 years after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Remote crafted multipart form request against public web app
allows remote attackers to cause a denial of service via a multipart/form-data encoded form
Application-layer DoS via crafted parameter name
allows remote attackers to cause a denial of service
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: struts:struts.
Upgrade to 1.2.9 or later
Set the version to 1.2.9 or later in your pom.xml or build.gradle.
The first fix for CVE-2006-1547. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 1.2.9 | 1.2.9 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.