IPA Catalogs Apache Struts 2 Vulnerability History

16 October 2018 medium vulnerability

Japan's IPA maintains a public tracker of Apache Struts 2 vulnerabilities and patch advisories, noting several early flaws were exploited domestically.

The Information-technology Promotion Agency (IPA) of Japan publishes and periodically updates a reference page cataloging known vulnerabilities in Apache Struts 2, a widely used Java web application framework. The page is intended for system integrators and developers who have built or maintain Struts-based websites, helping them identify which framework versions are affected by each disclosed vulnerability (identified by ASF's S2-xxx advisory numbers) and prompting timely patching.

The tracker spans advisories from S2-061 (2020) through the most recent S2-069 (added January 2026), covering a range of issue types including remote code execution and denial-of-service flaws across various Struts 2.0.x through 7.0.x version ranges. IPA notes that some of the earliest vulnerabilities in the list (affecting versions 2.0.0–2.3.16.3 and 2.3.20–2.3.28) were confirmed to have been exploited in Japan based on media reporting, though the page cautions that reported exploitation is not exhaustive and unreported attacks may have occurred domestically or abroad.

This is a living reference resource rather than a report on a specific active campaign; it primarily serves as a patch-management aid, urging organizations running Struts 2 to inventory their deployed version, check the associated library dependencies via JVN iPedia, and apply ASF's fixes promptly given the continuous public exposure of internet-facing web applications.

Detection guidance

Suspicious Child Process Spawned from Java/Tomcat Process (Possible Struts2 RCE)

ATT&CK T1190

Detects a shell or command interpreter being spawned by a Java/Tomcat web application process, consistent with exploitation of Apache Struts 2 remote code execution vulnerabilities (S2-xxx advisories) that achieve command execution via OGNL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned from Java/Tomcat Process
id: 1477e323-eb35-5495-9acb-61b5454474fb
status: experimental
description: 'Detects command interpreters or shells (cmd.exe, powershell.exe, sh,
  bash) spawned as a direct

  child of a Java or Tomcat process. This pattern is consistent with exploitation
  of Apache Struts 2

  remote code execution vulnerabilities (documented in the S2-xxx advisory series),
  where OGNL

  injection is used to invoke arbitrary OS commands from the web application process.

  '
references:
- https://www.ipa.go.jp
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
    - \catalina.sh
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh
    - \bash
    - \wscript.exe
    - \cscript.exe
  filter_common_admin:
    CommandLine|contains:
    - catalina.sh stop
    - catalina.sh start
    - shutdown.bat
  condition: selection_parent and selection_child and not filter_common_admin
falsepositives:
- Legitimate application startup/shutdown scripts that invoke shell wrappers from
  Tomcat's own management scripts
- Custom Java applications that intentionally shell out to OS utilities as part of
  normal operation
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant

Java Process Spawning Network Download Utility (Possible Struts2 Post-Exploitation)

ATT&CK T1190

Detects a Java/Tomcat process spawning common download utilities (curl, wget, certutil, bitsadmin), which is a frequent post-exploitation step after successful Apache Struts 2 RCE to retrieve secondary payloads or webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Spawning Network Download Utility
id: 93b43221-f26d-58c0-8e4c-3fb2059e57eb
status: experimental
description: 'Detects a Java or Tomcat process spawning common file download utilities
  such as curl, wget,

  certutil, or bitsadmin. This behaviour is commonly observed after successful exploitation
  of

  Apache Struts 2 remote code execution vulnerabilities (S2-xxx advisories), where
  the attacker

  uses the compromised web application process to fetch a webshell or secondary payload.

  '
references:
- https://www.ipa.go.jp
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat.exe
  selection_child:
    Image|endswith:
    - \curl.exe
    - \wget.exe
    - \certutil.exe
    - \bitsadmin.exe
  selection_download_args:
    CommandLine|contains:
    - http://
    - https://
    - -urlcache
    - -outfile
  condition: selection_parent and selection_child and selection_download_args
falsepositives:
- Legitimate Java applications that intentionally invoke OS-level download utilities
  for update checks
- Administrative scripts running under a Tomcat service account that download configuration
  files
level: medium
tags:
- attack.t1190
- attack.command_and_control
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/vuln/oss/struts2_list.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free