Exploit for Apache Struts Dynamic Method Invocation command execution

CVE-2016-3081

saint · 2016-05-06

Description

Apache Struts Dynamic Method Invocation command execution. Vulnerability in Dynamic Method Invocation feature allows remote code executio

Entry point

Parametermethod · query param

Pathstruts2-showcase/showcase.action

Remote code execution via Dynamic Method Invocation (DMI) in Struts2 when enabled, using method: prefix in request parameters.

Affected Apache Struts versions

Apache Struts= 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.11.1, 2.0.11.2, 2.0.12, 2.0.13, 2.0.14, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.8, 2.1.8.1, 2.2.1, 2.2.1.1, 2.2.3, 2.2.3.1, 2.3.1, 2.3.1.1, 2.3.1.2, 2.3.3, 2.3.4, 2.3.4.1, 2.3.7, 2.3.8, 2.3.12, 2.3.14

All known vulnerabilities by product

Apache Struts

CVSS 9.3 for CVE-2016-3081

9.3

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

82.9%higher than 99.7% of all CVEs

Updated 2026-08-24

Exploit Details

Modified:2016-05-06 00:00

Last Seen:2025-06-30 16:09

Reporter:SAINT Corporation

Other exploits for CVE-2016-3081

Apache Struts Dynamic Method Invocation Expression Handling RCE

2018-04-20 Dsquare SecurityD2

Apache Struts Dynamic Method Invocation command execution

2016-05-06 SAINT CorporationSAINT

Apache Struts Dynamic Method Invocation command execution

2016-05-06 SAINT CorporationSAINT

Apache Struts Dynamic Method Invocation command execution

2016-05-06 SAINT CorporationSAINT

Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)

2016-05-02 metasploitZDTRuby

Apache Struts - Dynamic Method Invocation Remote Code Execution (Metasploit)

2016-05-02 MetasploitEXPLOITDBRuby

Apache Struts 2.3.28 Dynamic Method Invocation Remote Code Execution

2016-04-30 NixawkPACKETSTORMRuby

Apache Struts Dynamic Method Invocation Remote Code Execution

2016-04-27 Nixawk, rungobierMETASPLOITRuby

Exploit Code

MARKDOWN31 lines

## https://sploitus.com/exploit?id=SAINT:C2F1CFAE3C24599334963A0CD12F3E0B
Added: 05/06/2016  
CVE: CVE-2016-3081  


### Background

Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller (MVC) architecture. 

The Dynamic Method Invocation feature allows the HTTP request to specify the name of the method to invoke. 

### Problem

A vulnerability in the Dynamic Method Invocation feature allows a remote attacker to execute arbitrary code by sending a specially crafted request containing a `**method:**` prefix. 

### Resolution

Upgrade to Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 or higher, or disable Dynamic Method Invocation in the web application. 

### References

https://struts.apache.org/docs/s2-032.html   


### Limitations

Exploit works on vulnerable versions of Apache Struts between 2.3.20 and 2.3.28 on Linux operating systems, and requires Dynamic Method Invocation to be enabled. 

### Platforms

Linux

Exploit Code

Share

Share on social media: