What is Struts Validator Turned Off (CWE-109)?

TL;DR: CWE-109 is a Struts action mapping with validate=”false” explicitly set, disabling input checking even when a real validation.xml entry exists for the form; the fix is re-enabling validate=”true” and confirming the rules still work correctly.

What is Struts Validator Turned Off?

Struts: Validator Turned Off (CWE-109) is a weakness that occurs when automatic filtering via a Struts bean has been turned off, disabling the Struts Validator and any custom validation logic tied to it. As defined by the MITRE Corporation under CWE-109, this weakness has no official OWASP Top 10:2025 category mapping and is a direct child of Improper Use of Validation Framework (CWE-1173) and Improper Input Validation (CWE-20).

Quick Summary

This is arguably more dangerous than a missing validation entry, precisely because it’s easy to miss on review: the validation.xml file looks complete and correct, with real rules defined for the form — but the action mapping’s validate="false" flag means Struts never actually runs them. Anyone auditing validation.xml alone, without also checking the action mapping, would conclude the form is protected when it isn’t.

Jump to: Quick Summary · Struts Validator Turned Off Overview · How Struts Validator Turned Off Works · Business Impact of Struts Validator Turned Off · Struts Validator Turned Off Attack Scenario · How to Detect Struts Validator Turned Off · How to Fix Struts Validator Turned Off · Framework-Specific Fixes for Struts Validator Turned Off · How to Ask AI to Check Your Code for Struts Validator Turned Off · Struts Validator Turned Off Best Practices Checklist · Struts Validator Turned Off FAQ · Vulnerabilities Related to Struts Validator Turned Off · References · Scan Your Own Site

Struts Validator Turned Off Overview

What: A Struts action mapping has validate="false" explicitly set, disabling the Validator framework for that form regardless of any rules defined for it.

Why it matters: It bypasses a protection mechanism that appears, on config-file review alone, to be in place and working.

Where it occurs: Struts 1.x action mappings in struts-config.xml, often left over from debugging or a rushed deployment.

Who is affected: Struts 1.x applications with any action mapping explicitly disabling the Validator.

Who is NOT affected: Applications where validate="true" (the default) is set on every action mapping with a corresponding validation entry.

How Struts Validator Turned Off Works

Root Cause

An action mapping has validate="false" explicitly set, which tells Struts to skip the Validator framework entirely for that action, regardless of what rules exist in validation.xml.

Attack Flow

1. A developer sets validate="false" on an action mapping, often temporarily while debugging a rule that was rejecting valid input.
2. The change is deployed without being reverted, while the corresponding validation.xml entry remains in place, unenforced.
3. A reviewer auditing validation.xml alone sees real, seemingly-complete validation rules and assumes the form is protected.
4. An attacker submits malicious input into the form’s fields; since the Validator never runs for this action, the input reaches application code completely unchecked.

Prerequisites to Exploit

• An action mapping has validate="false" explicitly set.
• A corresponding validation.xml entry may or may not exist — either way, it’s never enforced.
• The Action class or downstream code has an exploitable weakness that validation would otherwise have blocked or reduced.

Vulnerable Code

<!-- struts-config.xml -->
<action path="/updateProfile" type="com.example.ProfileAction" name="profileForm" validate="false"/>

<!-- validation.xml: real rules exist, but are never enforced because validate="false" above -->
<form-validation>
  <formset>
    <form name="profileForm">
      <field property="email" depends="required,email">
        <arg key="profileForm.email"/>
      </field>
    </form>
  </formset>
</form-validation>

The email field has a real validation rule defined, but validate="false" on the action mapping means Struts never runs the Validator for this action at all — the rule exists but is completely inert.

Secure Code

<!-- struts-config.xml -->
<action path="/updateProfile" type="com.example.ProfileAction" name="profileForm" validate="true"/>

Setting validate="true" (or simply removing the attribute, since true is the Struts default) re-enables the Validator for this action, so the existing email validation rule is actually enforced.

Business Impact of Struts Validator Turned Off

Access Control: MITRE classifies the direct consequence of this weakness as Bypass Protection Mechanism — a real, defined validation rule is rendered completely inert.

• False sense of security during config review, since validation.xml looks complete and correct in isolation
• Direct enabling of whatever downstream injection or input-driven vulnerability the disabled validation would have blocked

Struts Validator Turned Off Attack Scenario

1. A developer disables validation on a profile-update form (validate="false") while troubleshooting a rejected legitimate email format, intending it as temporary.
2. The change ships to production without being reverted; validation.xml still shows a complete-looking email validation rule.
3. An attacker submits a profile update with a script payload in a field that the (never-running) validator would have rejected.
4. Since the Validator never runs for this action, the payload reaches the profile page unfiltered, resulting in stored XSS against anyone who views the profile.

How to Detect Struts Validator Turned Off

Manual Testing

• Search struts-config.xml for any action mapping with validate="false" explicitly set.
• Cross-check whether a validation.xml entry exists for that form (which would be misleadingly unenforced).
• Submit input the corresponding validation rule should reject, and confirm whether it’s actually blocked.

Automated Scanners (SAST / DAST)

Static analysis can directly flag any action mapping with validate="false" in struts-config.xml, since this is a simple, deterministic configuration check.

PenScan Detection

PenScan’s scanner engines flag Struts action mappings with validate explicitly set to false, especially where a corresponding validation.xml entry exists but is never enforced.

False Positive Guidance

An action that intentionally handles all validation manually in its Action class code (with validate="false" as a deliberate, documented choice) may not be exploitable despite the flag — confirm whether manual validation actually covers every field before treating this as a real finding.

How to Fix Struts Validator Turned Off

• Set validate="true" (or remove the attribute, since true is the default) on the action mapping.
• Confirm the corresponding validation.xml rules actually pass for legitimate input before deploying the change.
• Treat any validate="false" found during a debugging session as a temporary state that must be reverted before merge, not left in place.

Framework-Specific Fixes for Struts Validator Turned Off

This weakness is specific to Apache Struts 1.x’s validate attribute on action mappings; modern frameworks handle validation enable/disable differently (often per-annotation rather than a single form-wide switch), so this exact pattern doesn’t apply there.

• Struts 1.x: set validate="true" on the action mapping and re-verify the corresponding validation.xml rules, as shown above.

How to Ask AI to Check Your Code for Struts Validator Turned Off

Struts Validator Turned Off Best Practices Checklist

✅ Set validate=”true” (or omit the attribute) on all action mappings ✅ Never leave a debugging-only validate=”false” in a deployed build ✅ Confirm validation rules actually pass for legitimate input after re-enabling ✅ Cross-check validate flags whenever auditing validation.xml, not the file alone

Struts Validator Turned Off FAQ

How does setting validate=”false” disable input checking?

The validate attribute on a Struts action mapping is the master switch for the Validator framework on that action — when it’s false, Struts skips the Validator entirely for that form, regardless of how thorough the corresponding validation.xml entry is.

How is this different from Struts: Unvalidated Action Form (CWE-108)?

CWE-108 is a missing validation.xml entry (no rules defined at all); CWE-109 is a form that HAS a validation.xml entry with real rules, but the action mapping explicitly disables the Validator anyway, so those rules never actually run.

How might a developer end up disabling validation unintentionally?

A common cause is temporarily setting validate=”false” while debugging a validation rule that was rejecting legitimate input, then forgetting to revert it before deploying — the validation.xml rules remain in the file, giving a false impression that the form is still protected.

How do I detect this in my own application?

Search struts-config.xml for any action mapping with validate=”false” explicitly set, and cross-check whether that form has a validation.xml entry that would otherwise be enforced.

How do I fix this correctly?

Set validate=”true” (or remove the attribute, since true is the default) on the action mapping, and confirm the corresponding validation.xml rules actually pass for legitimate input before deploying.

How does this weakness enable bypassing a protection mechanism specifically?

MITRE classifies the direct consequence as Bypass Protection Mechanism — from the attacker’s perspective, a validation rule that exists in validation.xml but is switched off is functionally identical to one that was never written, except the false sense of security it creates for anyone reviewing the config.

How can PenScan help find this weakness?

PenScan flags Struts action mappings with validate explicitly set to false, especially where a corresponding validation.xml entry exists but is never actually enforced.

Vulnerabilities Related to Struts Validator Turned Off

References

• MITRE - CWE-109
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find disabled Struts validation and other risks before an attacker does.