What is Struts: Form Bean Does Not Extend (CWE-104)?

Callout

TL;DR:

Struts: Form Bean Does Not Extend Validation Class (CWE-104) occurs when form beans do not extend the ActionForm subclass of the Validator framework, exposing the application to numerous types of attacks. To fix this vulnerability, ensure that all forms extend one of the Validation Classes.

At-a-Glance

What is Struts: Form Bean Does Not Extend Validation Class?

Struts: Form Bean Does Not Extend Validation Class (CWE-104) is a type of A05:2025 - Injection vulnerability that occurs when form beans do not extend the ActionForm subclass of the Validator framework. As defined by the MITRE Corporation under CWE-104, and classified by the OWASP Foundation under A05:2025 - Injection, this vulnerability exposes the application to numerous types of attacks.

Quick Summary

Struts: Form Bean Does Not Extend Validation Class (CWE-104) is a critical vulnerability in Java EE applications that occurs when form beans do not extend the ActionForm subclass of the Validator framework. This vulnerability exposes the application to numerous types of attacks, including cross-site scripting, process control, and SQL injection.

Jump to: TL;DR: · At-a-Glance · What is Struts: Form Bean Does Not Extend Validation Class? · Quick Summary · Struts: Form Bean Does Not Extend Validation Class Overview · How Struts: Form Bean Does Not Extend Validation Class Works · Business Impact of Struts: Form Bean Does Not Extend Validation Class · Struts: Form Bean Does Not Extend Validation Class Attack Scenario · How to Detect Struts: Form Bean Does Not Extend Validation Class · How to Fix Struts: Form Bean Does Not Extend Validation Class · Framework-Specific Fixes for Struts: Form Bean Does Not Extend Validation Class · How to Ask AI to Check Your Code for Struts: Form Bean Does Not Extend Validation Class · Struts: Form Bean Does Not Extend Validation Class Best Practices Checklist · Struts: Form Bean Does Not Extends Validation Class FAQ · Vulnerabilities Related to Struts: Form Bean Does Not Extend Validation Class · References · Scan Your Own Site

Struts: Form Bean Does Not Extend Validation Class Overview

What

Struts: Form Bean Does Not Extend Validation Class (CWE-104) is a type of A05:2025 - Injection vulnerability that occurs when form beans do not extend the ActionForm subclass of the Validator framework.

Why it matters

This vulnerability exposes the application to numerous types of attacks, including cross-site scripting, process control, and SQL injection. Unchecked input is an important component of these vulnerabilities.

Where it occurs

This vulnerability can occur in any Java EE application that uses Struts for form validation.

Who is affected

Any developer who creates forms in a Java EE application using Struts without extending the ActionForm subclass of the Validator framework is at risk of this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Struts: Form Bean Does Not Extend Validation Class Works

Root Cause

The root cause of this vulnerability is that form beans do not extend the ActionForm subclass of the Validator framework, exposing the application to numerous types of attacks.

Attack Flow

1. An attacker submits a malicious form with unchecked input.
2. The form bean does not extend the ActionForm subclass of the Validator framework.
3. The application processes the unchecked input without validation, leading to potential attacks.

Prerequisites to Exploit

To exploit this vulnerability, an attacker must be able to submit a malicious form with unchecked input.

Vulnerable Code

public class MyFormBean extends ActionForm {
    private String userInput;
    
    public void setInput(String input) {
        userInput = input;
    }
}

The vulnerable code above does not extend the ActionForm subclass of the Validator framework, exposing it to potential attacks.

Secure Code

public class MyFormBean extends ActionForm implements ValidationAware {
    private String userInput;
    
    public void setInput(String input) {
        if (input != null && !input.isEmpty()) {
            userInput = input;
        }
    }
}

The secure code above extends the ActionForm subclass of the Validator framework and includes validation logic to prevent potential attacks.

Business Impact of Struts: Form Bean Does Not Extend Validation Class

Confidentiality

This vulnerability can expose sensitive data, such as user credentials or financial information, to unauthorized access.

Integrity

This vulnerability can allow attackers to modify application data, leading to potential integrity issues.

Availability

This vulnerability can disrupt application availability by causing it to crash or become unresponsive.

Struts: Form Bean Does Not Extend Validation Class Attack Scenario

1. An attacker submits a malicious form with unchecked input.
2. The form bean does not extend the ActionForm subclass of the Validator framework.
3. The application processes the unchecked input without validation, leading to potential attacks.

How to Detect Struts: Form Bean Does Not Extend Validation Class

Manual Testing

• Review code for potential vulnerabilities.
• Test forms with malicious input to see if they are properly validated.

Automated Scanners (SAST / DAST)

Automated scanners like PenScan’s SAST and DAST engines can detect this vulnerability by analyzing code for potential input validation issues. However, dynamic analysis is required to test the actual behavior of the application under different inputs.

PenScan Detection

PenScan’s automated scanner engines actively test for this issue.

False Positive Guidance

Be cautious when reviewing scan results, as some patterns may look risky but are actually safe due to context a scanner can’t see. Always review code manually and consider the specific use case before making any changes.

How to Fix Struts: Form Bean Does Not Extend Validation Class

• Ensure that all forms extend one of the Validation Classes.
• Implement validation logic in form beans to prevent potential attacks.
• Regularly review and update code to ensure it remains secure.

Framework-Specific Fixes for Struts: Form Bean Does Not Extend Validation Class

Java EE

In Java EE applications, ensure that all forms extend the ActionForm subclass of the Validator framework. Implement validation logic in form beans to prevent potential attacks.

public class MyFormBean extends ActionForm implements ValidationAware {
    private String userInput;
    
    public void setInput(String input) {
        if (input != null && !input.isEmpty()) {
            userInput = input;
        }
    }
}

Node.js

In Node.js applications, ensure that all forms extend a custom form class that includes validation logic.

const express = require('express');
const app = express();

app.use(express.json());

class MyForm extends Form {
  constructor() {
    super();
    this.userInput = '';
  }
  
  setInput(input) {
    if (input != null && !input.isEmpty()) {
      this.userInput = input;
    }
  }
}

// Create a new instance of the form class
const myForm = new MyForm();

// Set the input value
myForm.setInput('malicious_input');

Python/Django

In Python/Django applications, ensure that all forms extend a custom form class that includes validation logic.

from django import forms

class MyForm(forms.Form):
    userInput = forms.CharField(max_length=255)

# Create a new instance of the form class
my_form = MyForm()

# Set the input value
my_form.userInput = 'malicious_input'

PHP

In PHP applications, ensure that all forms extend a custom form class that includes validation logic.

class MyForm extends Form {
    private $userInput;
    
    public function setInput($input) {
        if ($input != null && !empty($input)) {
            $this->userInput = $input;
        }
    }
}

// Create a new instance of the form class
$my_form = new MyForm();

// Set the input value
$my_form->setInput('malicious_input');

How to Ask AI to Check Your Code for Struts: Form Bean Does Not Extend Validation Class

To ask an AI coding assistant to review your code for potential CWE-104 vulnerabilities, you can use a prompt like this:

“Review the following Java code block for potential CWE-104 Struts: Form Bean Does Not Extend Validation Class vulnerabilities and rewrite it using validation logic in form beans to prevent potential attacks.”

public class MyFormBean extends ActionForm {
    private String userInput;
    
    public void setInput(String input) {
        userInput = input;
    }
}

Struts: Form Bean Does Not Extend Validation Class Best Practices Checklist

✅ Ensure that all forms extend one of the Validation Classes. ✅ Implement validation logic in form beans to prevent potential attacks. ✅ Regularly review and update code to ensure it remains secure.

Struts: Form Bean Does Not Extends Validation Class FAQ

How does Struts: Form Bean Does Not Extend Validation Class occur?

This vulnerability occurs when a form bean does not extend the ActionForm subclass of the Validator framework, exposing the application to other weaknesses related to insufficient input validation.

What is the impact of Struts: Form Bean Does Not Extend Validation Class on confidentiality and integrity?

Bypassing the validation framework for a form exposes the application to numerous types of attacks. Unchecked input is an important component of vulnerabilities like cross-site scripting, process control, and SQL injection.

What are some common consequences of Struts: Form Bean Does Not Extend Validation Class?

Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.

How can Struts: Form Bean Does Not Extend Validation Class be prevented?

Ensure that all forms extend one of the Validation Classes.

What are some framework-specific fixes for Struts: Form Bean Does Not Extend Validation Class in Java EE applications?

In Java EE applications, ensure that all forms extend the ActionForm subclass of the Validator framework.

How can I detect Struts: Form Bean Does Not Extend Validation Class using automated scanners (SAST / DAST)?

Automated scanners like PenScan’s SAST and DAST engines can detect this vulnerability by analyzing code for potential input validation issues.

What are some best practices to prevent Struts: Form Bean Does Not Extend Validation Class?

Ensure that all forms extend one of the Validation Classes, and use automated scanning tools to detect potential vulnerabilities.

Vulnerabilities Related to Struts: Form Bean Does Not Extend Validation Class

References

• MITRE CWE-104
• OWASP A05:2025 - Injection
• NIST NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Struts: Form Bean Does Not Extend Validation Class and other risks before an attacker does.