Jump to content

Apache Struts

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Thomasvincent (talk | contribs) at 07:18, 29 May 2025 (cleaned it up a bit). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.
For the predecessor of Apache Struts 2, see Apache Struts 1.
Apache Struts 2
Developer(s)Apache Software Foundation
Initial releaseOctober 10, 2006; 18 years ago (2006-10-10)
Stable release
7.0.3 / March 7, 2025; 4 months ago (2025-03-07)[1]
Repository
Written inJava
Operating systemCross-platform
PlatformCross-platform (JVM)
PredecessorApache Struts 1
TypeWeb framework
LicenseApache License 2.0
WebsiteOfficial website Edit this at Wikidata

Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller (MVC) architecture. The WebWork framework spun off from Apache Struts 1 aiming to offer enhancements and refinements while retaining the same general architecture of the original Struts framework. In December 2005, it was announced that WebWork 2.2 was adopted as Apache Struts 2, which reached its first full release in February 2007.[2]

Current status

Apache Struts 2 is actively maintained with regular releases. As of 2025, the project maintains two major versions:[3]

  • Struts 6.x series: Requires Java 8, Servlet API 3.1, and JSP API 2.1
  • Struts 7.x series: Requires Java 17 and Jakarta EE

The framework receives approximately 300,000 downloads per month, indicating continued widespread adoption.[4] The Struts 2.5.x branch reached end-of-life in 2023.[5]

Security issues

Struts 2 has a history of critical security bugs,[6] many tied to its use of OGNL technology.[7] Some vulnerabilities can lead to arbitrary code execution.

Equifax data breach

In October 2017, it was reported that failure by Equifax to address a Struts 2 vulnerability (CVE-2017-5638) advised in March 2017 was later exploited in the data breach that was disclosed by Equifax in September 2017.[8][9]

Recent vulnerabilities

In November 2024, Apache disclosed CVE-2024-53677, a critical vulnerability with a CVSS severity rating of 9.5 out of 10, affecting applications using the deprecated FileUploadInterceptor. This vulnerability allows for path traversal, malicious file uploads, and remote code execution.[10]

Features

Apache Struts 2 provides the following features:

Core features

  • Simple POJO-based actions[11]
  • Simplified testability
  • Thread-safe architecture
  • Template support[12]
  • Support for different result types[13]
  • Easy extensibility through plugins

Ajax and UI support

Integration plugins

  • REST plugin[15] for REST-based actions and extension-less URLs
  • Convention plugin for configuration via conventions and annotations
  • Spring plugin[16] for dependency injection
  • Hibernate plugin for ORM support
  • JFreechart plugin for chart generation
  • Rome plugin for RSS/Atom feed support

Version history

Major releases

  • Struts 2.0 (2007): Initial release after merger with WebWork
  • Struts 2.5 (2016–2023): Long-term support version, reached end-of-life in 2023
  • Struts 6.0 (2022): Introduced modularization and improved security features
  • Struts 7.0 (2024): Migrated to Jakarta EE, requires Java 17

See also

Notes

  1. ^ "Struts 7.0.3". GitHub. Retrieved 16 March 2025.
  2. ^ "About Apache Struts 2". Archived from the original on January 14, 2014. Retrieved 2014-01-14.
  3. ^ "Announcements 2025". Apache Struts. Retrieved 2025-05-29.
  4. ^ Jones, Connor (December 12, 2024). "Apache issues patches for critical Struts 2 RCE bug". The Register. Retrieved 2025-05-29.
  5. ^ "Announcements 2023 - Apache Struts". Apache Struts. Retrieved 2025-05-29.
  6. ^ "Apache Struts : List of security vulnerabilities". CVE Details. Retrieved October 2, 2017.
  7. ^ Munoz, Alvaro (January 14, 2014). "Struts 2: OGNL Expression Injections". HPE.com. Archived from the original on October 3, 2017. Retrieved October 2, 2017.
  8. ^ Chirgwin, Richard (October 2, 2017). "Equifax couldn't find or patch vulnerable Struts implementations". The Register. Retrieved October 2, 2017.
  9. ^ Goodin, Dan (October 2, 2017). "A series of delays and major errors led to massive Equifax breach". Ars Technica. Retrieved October 2, 2017.
  10. ^ "CVE-2024-53677 - Vulnerability impacting Apache Struts 2". Canadian Centre for Cyber Security. November 26, 2024. Retrieved 2025-05-29.
  11. ^ Newton 2009, p. 9, §1 Struts and Agile Development - Actions.
  12. ^ Newton 2009, p. 294, §12 Comprehensive Testing - Detour: Struts and Spring in a nutshell.
  13. ^ Newton 2009, pp. 57–81, §4 Results and Result Types - Dojo tags.
  14. ^ Newton 2009, p. 258, §13 Rich Internet Applications - Dojo tags.
  15. ^ Newton 2009, pp. 249–255, §12 Themes and Templates - The REST plug-in.
  16. ^ Newton 2009, p. 294, §13 Comprehensive Testing - Detour: Struts and Spring in a nutshell.

References

Retrieved from "https://en.wikipedia.org/w/index.php?title=Apache_Struts&oldid=1292865742"