IPA Catalogs Apache Struts 2 Vulnerability History
Japan's IPA maintains a public tracker of Apache Struts 2 vulnerabilities and patch advisories, noting several early flaws were exploited domestically.
Sourceipa.go.jp — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Information-technology Promotion Agency (IPA) of Japan publishes and periodically updates a reference page cataloging known vulnerabilities in Apache Struts 2, a widely used Java web application framework. The page is intended for system integrators and developers who have built or maintain Struts-based websites, helping them identify which framework versions are affected by each disclosed vulnerability (identified by ASF's S2-xxx advisory numbers) and prompting timely patching.
The tracker spans advisories from S2-061 (2020) through the most recent S2-069 (added January 2026), covering a range of issue types including remote code execution and denial-of-service flaws across various Struts 2.0.x through 7.0.x version ranges. IPA notes that some of the earliest vulnerabilities in the list (affecting versions 2.0.0–2.3.16.3 and 2.3.20–2.3.28) were confirmed to have been exploited in Japan based on media reporting, though the page cautions that reported exploitation is not exhaustive and unreported attacks may have occurred domestically or abroad.
This is a living reference resource rather than a report on a specific active campaign; it primarily serves as a patch-management aid, urging organizations running Struts 2 to inventory their deployed version, check the associated library dependencies via JVN iPedia, and apply ASF's fixes promptly given the continuous public exposure of internet-facing web applications.
Detection guidance
Suspicious Child Process Spawned from Java/Tomcat Process (Possible Struts2 RCE)
A behavioural hunt for the technique in general.
Detects a shell or command interpreter being spawned by a Java/Tomcat web application process, consistent with exploitation of Apache Struts 2 remote code execution vulnerabilities (S2-xxx advisories) that achieve command execution via OGNL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Java/Tomcat Process
id: 1477e323-eb35-5495-9acb-61b5454474fb
status: experimental
description: 'Detects command interpreters or shells (cmd.exe, powershell.exe, sh,
bash) spawned as a direct
child of a Java or Tomcat process. This pattern is consistent with exploitation
of Apache Struts 2
remote code execution vulnerabilities (documented in the S2-xxx advisory series),
where OGNL
injection is used to invoke arbitrary OS commands from the web application process.
'
references:
- https://www.ipa.go.jp
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
- \catalina.sh
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wscript.exe
- \cscript.exe
filter_common_admin:
CommandLine|contains:
- catalina.sh stop
- catalina.sh start
- shutdown.bat
condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate application startup/shutdown scripts that invoke shell wrappers from
Tomcat's own management scripts
- Custom Java applications that intentionally shell out to OS utilities as part of
normal operation
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant
Java Process Spawning Network Download Utility (Possible Struts2 Post-Exploitation)
A behavioural hunt for the technique in general.
Detects a Java/Tomcat process spawning common download utilities (curl, wget, certutil, bitsadmin), which is a frequent post-exploitation step after successful Apache Struts 2 RCE to retrieve secondary payloads or webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Network Download Utility
id: 93b43221-f26d-58c0-8e4c-3fb2059e57eb
status: experimental
description: 'Detects a Java or Tomcat process spawning common file download utilities
such as curl, wget,
certutil, or bitsadmin. This behaviour is commonly observed after successful exploitation
of
Apache Struts 2 remote code execution vulnerabilities (S2-xxx advisories), where
the attacker
uses the compromised web application process to fetch a webshell or secondary payload.
'
references:
- https://www.ipa.go.jp
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \tomcat.exe
selection_child:
Image|endswith:
- \curl.exe
- \wget.exe
- \certutil.exe
- \bitsadmin.exe
selection_download_args:
CommandLine|contains:
- http://
- https://
- -urlcache
- -outfile
condition: selection_parent and selection_child and selection_download_args
falsepositives:
- Legitimate Java applications that intentionally invoke OS-level download utilities
for update checks
- Administrative scripts running under a Tomcat service account that download configuration
files
level: medium
tags:
- attack.t1190
- attack.command-and-control
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/vuln/oss/struts2_list.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs