Intel

CVE-2006-1547

Improper Input Validation in Apache Struts

criticalKEV: actively exploitedPoCEPSS 55%

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Source: OSVNVDCISA_KEVCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2006-1547 appears on CISA KEV because Apache Struts 1.x persists as an unpatched legacy component in many organisations — particularly in critical infrastructure sectors with long maintenance cycles such as energy, healthcare, and finance. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N describes a remotely triggerable availability impact requiring no authentication and no user interaction, making the attack trivially executable from the internet. The EPSS score of 54.6 % (99th percentile) places this vulnerability in the top 1 % of all CVEs by exploitation likelihood, despite its age. No CISA ransomware-campaign flag is set; however, an unplanned outage of a Struts-based business application may trigger NIS2 Article 21 incident-reporting obligations if availability thresholds are breached — patch prioritisation is therefore both a security and a compliance imperative.

Runbook · Step 1

Immediate response (0-24 h)

  • Upgrade Apache Struts to version 1.2.9 or later — this is the only complete fix; obtain the release from the Apache Software Foundation official archive.
  • Inventory all application servers running Struts 1.x with BeanUtils 1.7; prioritise patching on externally reachable instances (JBoss, WebSphere, WebLogic, Tomcat deployments are common carriers of this legacy stack).
  • Until the patch is applied, block or strip inbound multipart/form-data POST requests containing parameter names referencing multipartRequestHandler at the WAF or reverse-proxy layer.
  • Isolate affected applications behind a reverse proxy (nginx, Apache httpd) and close direct internet paths to Struts endpoints where external access is not strictly required.
  • Enable resource monitoring (CPU, JVM heap, thread-pool exhaustion) on affected application servers to detect an active DoS condition in real time.

Runbook · Step 2

Mitigation layers

  • WAF/reverse proxy: Reject POST requests whose body parameters contain the string multipartRequestHandler or getMultipartRequestHandler. Example nginx snippet: if ($request_body ~* "multipartRequestHandler") { return 403; } — alternatively, a ModSecurity rule inspecting ARGS_NAMES achieves the same effect.
  • Network segmentation: Place Struts application servers in a dedicated VLAN; route all inbound HTTP/HTTPS traffic (TCP 80/443) exclusively through the WAF proxy — no direct internet-facing exposure.
  • Rate limiting: Cap multipart upload requests to a reasonable threshold per source IP (e.g. 20 req/min) at the proxy layer to slow exhaustion attempts.
  • BeanUtils upgrade: Confirm BeanUtils is not left at version 1.7; upgrade it in parallel with the Struts patch to eliminate the unconstrained property-traversal path.
  • Least-privilege process hardening: Run Struts applications under dedicated low-privilege service accounts; enforce JVM heap limits (-Xmx) to contain the blast radius of a successful DoS to the individual JVM rather than the host.

Runbook · Step 3

Detection rules

  • Web-server access log: POST requests where the body contains multipartRequestHandler — SPL snippet: index=webaccess method=POST | search request_body="*multipartRequestHandler*".
  • Suricata/Snort: Signature matching content:"multipartRequestHandler" in the HTTP request body, inbound direction; set a threshold of 5 hits per 60 s per source IP to suppress noise.
  • Application-server log (Tomcat/JBoss): Repeated OutOfMemoryError or StackOverflowError entries in catalina.out / server.log correlated with Struts ActionForm class names and matching inbound POST timestamps.
  • JVM metrics (JMX/Prometheus): Alert when heap utilisation exceeds 90 % for more than 60 consecutive seconds alongside an elevated thread count on Struts endpoints.
  • Sigma rule shape (generic): 
    title: CVE-2006-1547 Struts DoS Attempt
logsource: category=webserver
detection:
  keywords: 'multipartRequestHandler'
  method: POST
condition: keywords and method

Metrics

Severity
critical
Priority score
198.10
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
7.5
CVSS v4
—
EPSS percentile
99.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
54.6 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-05-01 06:50 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apache

    struts1.2.9

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2006-1547