CVE-2020-17530
Published: 11 December 2020
Summary
CVE-2020-17530 is a critical-severity Expression Language Injection (CWE-917) vulnerability in Oracle Communications Diameter Intelligence Hub. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Deeper analysis
The vulnerability is forced OGNL evaluation when evaluated on raw user input in tag attributes, which may lead to remote code execution. It affects Apache Struts versions 2.0.0 through 2.5.25 and is associated with CWE-917.
An attacker can exploit the issue remotely over a network without authentication or user interaction, as reflected in the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), resulting in arbitrary code execution with full impact on confidentiality, integrity, and availability.
Advisories and additional details are referenced at https://cwiki.apache.org/confluence/display/WW/S2-061 along with JVN, Packet Storm, OpenWall, and NetApp security notices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1073
Vulnerability details
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before it reaches expression evaluation (OGNL), blocking the exact injection path in Struts tag attributes.
Enforces strict information-flow rules on user-supplied data so that raw input cannot be interpreted as executable OGNL expressions.
Restricts the web-application runtime to only the functionality needed, disabling or sandboxing dynamic expression evaluation features that enable the RCE.