CWE-106: Struts: Plug-in Framework not in Use
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Last updated
Overview
Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
Common consequences
What can happen when CWE-106 is exploited.
Unexpected State
Affects: Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-106, grouped by where in the lifecycle they apply.
Use an input validation framework such as Struts.
Use an input validation framework such as Struts.
Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that:
- Phone number fields contain only valid characters in phone numbers
- Boolean values are only "T" or "F"
- Free-form strings are of a reasonable length and composition
Use the Struts Validator to validate all program input before it is processed by the application. Ensure that there are no holes in the configuration of the Struts Validator. Example uses of the validator include checking to ensure that:
- Phone number fields contain only valid characters in phone numbers
- Boolean values are only "T" or "F"
- Free-form strings are of a reasonable length and composition
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for an online business site. The user will enter registration data and, through the Struts framework, the RegistrationForm bean will maintain the user data.
Vulnerable example
public class RegistrationForm extends org.apache.struts.action.ActionForm {Safe example
public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {Safe example
<struts-config>Terminology & mappings
Mapped taxonomies
- 7 Pernicious Kingdoms: Struts: Plug-in Framework Not In Use
Frequently asked questions
Common questions about CWE-106.
- What is CWE-106?
- When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
- How do you prevent CWE-106?
- Use an input validation framework such as Struts.
- What are the consequences of CWE-106?
- Exploiting CWE-106 can lead to: Unexpected State.
References
- MITRE CWE definition (CWE-106) (opens in a new tab)
- CWE-106 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-106
Get alerted the moment a new CWE-106 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.