CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
- Published
- Dec 11, 2020
- Updated
- Oct 21, 2025
- Assigning CNA
- apache
- Evidence observed
- Nov 3, 2021
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
Sources
struts2/s2-061
Struts2 S2-061 Remote Code Execution Vulnerablity (CVE-2020-17530)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/struts2:2.5.25(struts2/s2-061/docker-compose.yml:services.struts2.image)
http/cves/2020/CVE-2020-17530.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex($.matchers[*].type)
modules/exploits/multi/http/struts2_multi_eval_ognl.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_multi/http/struts2_multi_eval_ognl.platform)
- verification: check_declared($.exploit_multi/http/struts2_multi_eval_ognl.check)
S2-061 CVE-2020-17530
- CVE-2020-17530Exploit
Python exploit for OGNL injection (CVE-2020-17530) in Apache Struts2/Tomcat, enabling remote command execution on vulnerable targets.
- CVE-2020-17530Exploit
Python-based exploit for Struts2 S2-061 (CVE-2020-17530) remote command execution vulnerability. Supports single URL, file-based scanning, proxy, and output logging.
- CVE-2020-17530-s2-061Exploit
GUI-based exploit for CVE-2020-17530 (Apache Struts2 S2-061) with built-in reverse shell function for educational and penetration testing purposes.
- CVE-2020-17530Exploit
Apache Struts2框架是一个用于开发Java EE网络应用程序的Web框架。Apache Struts于2020年12月08日披露 S2-061 Struts 远程代码执行漏洞（CVE-2020-17530），在使用某些tag等情况下可能存在OGNL表达式注入漏洞，从而造成远程代码执行，风险极大。提醒我校Apache Struts用户尽快采取安全措施阻止漏洞攻击。
- CVE-2020-17530Exploit
S2-061 的payload，以及对应简单的PoC/Exp
- CVE-2020-17530-strust2-061Exploit
Exploit for CVE-2020-17530 (Apache Struts2 S2-061) vulnerability. Provides remote code execution payload generation and testing against vulnerable Struts2 applications.
Proof-of-concept exploit for CVE-2020-17530 (Apache Struts2 S2-061) with OGNL injection payload for remote code execution testing.
Proof-of-concept exploit script for CVE-2020-17530 (Struts2 S2-061 FreeMarker RCE). Executes arbitrary commands on vulnerable Apache Struts2 servers via crafted FreeMarker template injection.
Vulnerable environment of CVE-2020-17530 (S2-061) for testing
- CVE-2020-17530Exploit
- CVE-2021-31805Exploit
S2-061/S2-062 Struts2 远程命令执行漏洞 POC&EXP
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.