CVE-2016-3081: Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Overview
Apache Struts 2, across several release lines between 2.3.20 and 2.3.28, contains a command injection flaw that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability is present when Dynamic Method Invocation is enabled in the application configuration. An attacker who can reach the application over the network can send a crafted HTTP request containing a malicious OGNL expression via the method: prefix in the action URL, causing the server to execute attacker-controlled operating system commands.
Vulnerability details
Apache Struts 2 supports Dynamic Method Invocation, which allows callers to specify an action method by appending a method: prefix to a URL. In affected versions, the framework passes the supplied value to the OGNL expression evaluator without adequate sanitization. OGNL is a full expression language with access to Java runtime objects, so an attacker-supplied expression can reach java.lang.Runtime and similar classes. This is a classic command injection pattern under CWE-77: user-controlled input crosses a trust boundary and is evaluated as a command rather than treated as data.
An attacker sends a crafted HTTP request to any reachable Struts 2 action endpoint, embedding a chained OGNL expression in the URL via the method: prefix. The expression first manipulates _memberAccess to bypass OGNL security restrictions, then invokes Runtime.exec() to run arbitrary OS commands. No authentication is required. Successful exploitation gives the attacker code execution with the privileges of the web server process, including the ability to run shell commands, write files to disk, and establish persistent access.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor web server and application access logs for requests containing
method:in the URL path or query string, particularly when combined with OGNL-characteristic tokens such as@,Runtime,exec,_memberAccess, orOgnlContext. - Alert on unexpected child processes spawned by the Java application server process (for example,
javaspawningsh,bash,cmd.exe, orchmod), which indicates successful OS command execution via OGNL injection. - Audit the Struts configuration for the
struts.enable.DynamicMethodInvocationsetting; a value oftrueon an internet-facing application confirms active exposure and should be treated as a finding independent of exploit traffic.
Remediation
Additional hardening
- Upgrade Apache Struts to 2.3.20.3 or later in the 2.3.20 line, 2.3.24.3 or later in the 2.3.21 line, or 2.3.28.1 or later in the 2.3.25 line; see the vendor advisory (S2-032) in the References section for full version guidance.
- Disable Dynamic Method Invocation immediately if upgrading is not possible: set
struts.enable.DynamicMethodInvocationtofalseinstruts.propertiesorstruts.xml. The vendor identifies this as the primary workaround. - Restrict network access to Struts action endpoints at the perimeter or load balancer, limiting exposure to known client IP ranges where the application's use case permits.
- Deploy a web application firewall rule that blocks requests containing
method:combined with OGNL expression syntax in URL parameters, as a compensating control while patching is in progress.
Key dates
References
- https://struts.apache.org/docs/s2-032.html
- https://cwiki.apache.org/confluence/display/WW/S2-032
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2016-3081
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/39756/
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Frequently asked questions
Does CVE-2016-3081 affect my FedRAMP authorization?
If Apache Struts runs inside your authorization boundary, yes. CVE-2016-3081 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and the remediation deadline of October 11, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2016-3081?
Knox does not patch your Apache Struts deployment. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to carry out that work in, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch is your responsibility; managing your compliance posture while you do it is not something you have to handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2016-3081. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at scheduled review time, giving you a shorter window between disclosure and awareness.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2016-3081's remediation deadline of October 11, 2026 has passed. What happens now?
An unremediated CVE-2016-3081 is already a Plan of Action and Milestones (POA&M) item, and a growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out now and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
