CVE-2011-3923

CRITICAL

Apache Struts <2.3.1.2 - Command Injection

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2011-3923. PoCs published by Metasploit, Meder Kydyraliev, including Metasploit module exploits/multi/http/struts_code_exec_parameters.

AI-analyzed exploit summary This Metasploit module exploits CVE-2011-3923, a remote code execution vulnerability in Apache Struts versions < 2.3.1.2 via OGNL expression injection in the ParametersInterceptor. It supports multiple platforms (Windows, Linux, Java) and delivers payloads through chunked file uploads.

Description

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotemultiple

https://www.exploit-db.com/exploits/24874

View Code ZIP pw:eip

This Metasploit module exploits CVE-2011-3923, a remote code execution vulnerability in Apache Struts versions < 2.3.1.2 via OGNL expression injection in the ParametersInterceptor. It supports multiple platforms (Windows, Linux, Java) and delivers payloads through chunked file uploads.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Apache Struts < 2.3.1.2

No auth needed

Prerequisites: Target running vulnerable Apache Struts version · Access to a Struts action endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

by Meder Kydyraliev · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts_code_exec_parameters.rb