What is Struts: Plug-in Framework not in Use (CWE-106)?

AI-friendly summary

TL;DR: Struts: Plug-in Framework not in Use (CWE-106) is a high-severity vulnerability that occurs when an application does not use an input validation framework, allowing potential weaknesses related to insufficient input validation. To fix it, use an input validation framework such as the Struts Validator or implement libraries or frameworks that provide input validation.

At-a-Glance

What is Struts: Plug-in Framework not in Use?

Struts: Plug-in Framework not in Use (CWE-106) is a type of input validation framework not being used, which can introduce weaknesses related to insufficient input validation. As defined by the MITRE Corporation under CWE-106, and classified by the OWASP Foundation as not directly mapped, this vulnerability occurs when an application does not use an input validation framework.

Quick Summary

Struts: Plug-in Framework not in Use (CWE-106) is a high-severity vulnerability that can lead to unexpected state and integrity issues. This vulnerability occurs when an application does not use an input validation framework such as the Struts Validator, allowing potential weaknesses related to insufficient input validation. To fix it, use an input validation framework or implement libraries or frameworks that provide input validation.

Jump to: At-a-Glance · What is Struts: Plug-in Framework not in Use? · Quick Summary · Struts: Plug-in Framework not in Use Overview · How Struts: Plug-in Framework not in Use Works · Business Impact of Struts: Plug-in Framework not in Use · Struts: Plug-in Framework not in Use Attack Scenario · How to Detect Struts: Plug-in Framework not in Use · How to Fix Struts: Plug-in Framework not in Use · Framework-Specific Fixes for Struts: Plug-in Framework not in Use · How to Ask AI to Check Your Code for Struts: Plug-in Framework not in Use · Struts: Plug-in Framework not in Use Best Practices Checklist · Struts: Plug-in Framework not in Use FAQ · Vulnerabilities Related to Struts: Plug-in Framework not in Use · References · Scan Your Own Site

Struts: Plug-in Framework not in Use Overview

What

Struts: Plug-in Framework not in Use (CWE-106) is a type of input validation framework not being used, which can introduce weaknesses related to insufficient input validation.

Why it matters

This vulnerability can lead to unexpected state and integrity issues, making it a high-severity issue that requires attention.

Where it occurs

This vulnerability typically occurs in applications developed using Java, Java EE, EJB, or Struts.

Who is affected

Developers and users of applications developed using Java, Java EE, EJB, or Struts are affected by this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input or systems already using an input validation framework such as the Struts Validator are not affected by this vulnerability.

How Struts: Plug-in Framework not in Use Works

Root Cause

The root cause of this vulnerability is the lack of use of an input validation framework such as the Struts Validator.

Attack Flow

1. An attacker sends a malicious request to the application.
2. The application does not validate the input, allowing the attacker to inject malicious code.
3. The malicious code is executed, leading to unexpected state and integrity issues.

Prerequisites to Exploit

The prerequisites for exploiting this vulnerability include:

• The application not using an input validation framework such as the Struts Validator.
• The attacker sending a malicious request to the application.

Vulnerable Code

public class Example {
  public void validateInput(String input) {
    // No validation is performed on the input.
  }
}

The vulnerable code above does not perform any validation on the input, allowing an attacker to inject malicious code.

Secure Code

public class Example {
  public void validateInput(String input) {
    if (!input.matches("^[a-zA-Z0-9]+$")) {
      throw new IllegalArgumentException("Invalid input");
    }
  }
}

The secure code above performs validation on the input, rejecting any input that does not match the regular expression.

Business Impact of Struts: Plug-in Framework not in Use

Confidentiality

This vulnerability can lead to unexpected state and integrity issues, potentially exposing sensitive data.

Integrity

This vulnerability can lead to unexpected state and integrity issues, potentially allowing an attacker to modify sensitive data.

Availability

This vulnerability can lead to unexpected state and integrity issues, potentially disrupting the availability of the application.

The business impact of this vulnerability includes:

• Financial losses due to downtime or data breaches.
• Compliance issues due to failure to protect sensitive data.
• Reputation damage due to public exposure of the vulnerability.

Struts: Plug-in Framework not in Use Attack Scenario

1. An attacker sends a malicious request to the application, attempting to inject malicious code.
2. The application does not validate the input, allowing the attacker to inject malicious code.
3. The malicious code is executed, leading to unexpected state and integrity issues.

How to Detect Struts: Plug-in Framework not in Use

Manual Testing

To detect this vulnerability manually, perform the following steps:

• Review the application’s code for any instances of input validation.
• Test the application with malicious input to see if it can inject malicious code.

Automated Scanners (SAST/DAST)

Automated scanners can also be used to detect this vulnerability. However, they may not catch all instances of the vulnerability, especially if the application is using complex input validation mechanisms.

PenScan Detection

PenScan’s scanner engines actively test for this issue and provide detailed reports on any vulnerabilities found.

False Positive Guidance

To avoid false positives when detecting this vulnerability:

• Ensure that the application is properly configured to handle malicious input.
• Use a combination of manual testing and automated scanning to detect the vulnerability.

How to Fix Struts: Plug-in Framework not in Use

To fix this vulnerability, use an input validation framework such as the Struts Validator or implement libraries or frameworks that provide input validation. This can be done by:

• Configuring the application to use an input validation framework.
• Implementing custom input validation mechanisms.

Framework-Specific Fixes for Struts: Plug-in Framework not in Use

Java

To fix this vulnerability in Java, use the @Valid annotation on any method that accepts user input. This will enable input validation using the Struts Validator.

public class Example {
  @Valid
  public void validateInput(String input) {
    // Input is validated using the Struts Validator.
  }
}

Node.js

To fix this vulnerability in Node.js, use a library such as express-validator to implement custom input validation mechanisms.

const express = require('express');
const app = express();

app.post('/example', (req, res) => {
  const { input } = req.body;
  if (!input.matches("^[a-zA-Z0-9]+$")) {
    return res.status(400).send({ message: 'Invalid input' });
  }
});

Python/Django

To fix this vulnerability in Python/Django, use a library such as django-formtools to implement custom input validation mechanisms.

from django import forms

class ExampleForm(forms.Form):
  input = forms.CharField(max_length=255)

def validate_input(request):
  form = ExampleForm(request.POST)
  if form.is_valid():
    # Input is validated using the Django Validator.
    return True
  else:
    return False

PHP

To fix this vulnerability in PHP, use a library such as laravel-validator to implement custom input validation mechanisms.

use Illuminate\Support\Facades\Validator;

public function validateInput(Request $request)
{
  $input = $request->input('input');
  if (!Validator::make($input, '^[a-zA-Z0-9]+$')->passes()) {
    return response()->json(['message' => 'Invalid input'], 400);
  }
}

How to Ask AI to Check Your Code for Struts: Plug-in Framework not in Use

To ask an AI coding assistant to check your code for this vulnerability:

1. Review the code and identify any instances of input validation.
2. Provide a copy-pasteable prompt to the AI, including the language and primary fix technique.

<code>
public class Example {
  @Valid
  public void validateInput(String input) {
    // Input is validated using the Struts Validator.
  }
}
</code>

Struts: Plug-in Framework not in Use Best Practices Checklist

✅ Review the application’s code for any instances of input validation.

✅ Test the application with malicious input to see if it can inject malicious code.

✅ Configure the application to use an input validation framework such as the Struts Validator.

✅ Implement custom input validation mechanisms using libraries or frameworks that provide input validation.

Struts: Plug-in Framework not in Use FAQ

How does Struts: Plug-in Framework not in Use occur?

Struts: Plug-in Framework not in Use occurs when an application does not use an input validation framework such as the Struts Validator, allowing potential weaknesses related to insufficient input validation.

What is the typical severity of Struts: Plug-in Framework not in Use?

The typical severity of Struts: Plug-in Framework not in Use varies by instance but is typically 7.5-9.0 under CVSS v3.1, depending on exploitability and impact.

How can I detect Struts: Plug-in Framework not in Use?

You can detect Struts: Plug-in Framework not in use through manual testing, automated scanners (SAST/DAST), or PenScan detection.

What are the common consequences of Struts: Plug-in Framework not in Use?

The common consequences of Struts: Plug-in Framework not in Use include unexpected state and integrity issues.

How can I fix Struts: Plug-in Framework not in Use?

You can fix Struts: Plug-in Framework not in use by using an input validation framework such as the Struts Validator or implementing libraries or frameworks that provide input validation.

What are some best practices for preventing Struts: Plug-in Framework not in Use?

Some best practices for preventing Struts: Plug-in Framework not in Use include verifying return values, testing your code, and using an allowlist of settings permitted to be user-changeable.

What are some related vulnerabilities to Struts: Plug-in Framework not in Use?

CWE-1173 (Improper Use of Validation Framework) and CWE-20 (Improper Input Validation) are related vulnerabilities to Struts: Plug-in Framework not in Use.

Vulnerabilities Related to Struts: Plug-in Framework not in Use

References

• MITRE CWE-106
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Struts: Plug-in Framework not in Use and other risks before an attacker does.