CVE-2011-3923: Remote code execution via OGNL injention in HTTP parameter values

November 1, 2019 (updated December 2, 2019)

OGNL provides, among other features, extensive expression evaluation capabilities. The vulnerability allows a malicious user to bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.

References

struts.apache.org/docs/s2-009.html

Code Behaviors & Features

Detect and mitigate CVE-2011-3923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →