界: Input Validation and Representation

输入验证与表示问题是由元字符、交替编码和数字表示引起的。安全问题源于信任输入。这些问题包括：“Buffer Overflows”、“Cross-Site Scripting”攻击、“SQL Injection”等其他问题。

OGNL Expression Injection: Struts 2

Java/JSP

Abstract

应用程序采用开发模式 (devMode) 部署，允许在服务器上执行任意命令及泄露有关应用程序编码方法的详细信息。

Explanation

Struts 2 包含名为 devMode（开发模式）的设置。启用此设置后，Struts 2 将提供额外的日志记录和调试信息，这样可以显著加快开发速度，但却会对性能和安全性产生极大的影响。devMode 将调试级别或通常可忽略的问题升级为通常在正常模式下不会抛出的异常。

devMode 还启用了一些调试功能，使开发人员能够检查值堆栈中存储的变量。这些功能可以使用 debug 请求参数触发：
- debug=console 将弹出 OGNL 评估控制台，允许开发人员对服务器上的任意 OGNL 表达式进行评估。
- debug=command 将允许开发人员提交任意 OGNL 表达式，以使用请求参数 expression 进行评估。
- debug=xml 可将参数、上下文、会话和值堆栈转储为一个 XML 文档。
- debug=browser 可将参数、上下文、会话和值堆栈转储在一个可浏览的 HTML 文档中。

References

[1] Apache Struts 2 Documentation - devMode

[2] Apache Struts 2 Documentation - Debugging

[3] Meder Kydyraliev Milking a horse or executing remote code in modern Java frameworks

[4] Standards Mapping - Common Weakness Enumeration CWE ID 94, CWE ID 95

[5] Standards Mapping - Common Weakness Enumeration Top 25 2019 [18] CWE ID 094

[6] Standards Mapping - Common Weakness Enumeration Top 25 2020 [17] CWE ID 094

[7] Standards Mapping - Common Weakness Enumeration Top 25 2022 [25] CWE ID 094

[8] Standards Mapping - Common Weakness Enumeration Top 25 2023 [23] CWE ID 094

[9] Standards Mapping - Common Weakness Enumeration Top 25 2024 [11] CWE ID 094

[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754

[11] Standards Mapping - FIPS200 SI

[12] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)

[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation

[15] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.2.4 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.5 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.2.8 Sanitization and Sandboxing Requirements (L1 L2 L3), 5.3.6 Output Encoding and Injection Prevention Requirements (L1 L2 L3)

[16] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[17] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation

[18] Standards Mapping - OWASP Top 10 2004 A6 Injection Flaws

[19] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws

[20] Standards Mapping - OWASP Top 10 2010 A1 Injection

[21] Standards Mapping - OWASP Top 10 2013 A1 Injection

[22] Standards Mapping - OWASP Top 10 2017 A1 Injection

[23] Standards Mapping - OWASP Top 10 2021 A03 Injection

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation

[36] Standards Mapping - SANS Top 25 2009 Risky Resource Management - CWE ID 094

[37] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3570 CAT I

[38] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3570 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3570 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3570 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3570 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3570 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3570 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I

[54] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I

[55] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I

[56] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I

[57] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[58] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I

[59] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)

desc.config.java.ognl_expression_injection_struts2_devmode