After last weeks update to fix a security flaw in Apache, the developers have released another important security fix. The fix addresses two problems: The framework allows action mapping based on wildcards and when a request doesn't match an action, it tries to load a JSP file based on the name of the action. That name can be treated as an OGNL expression and in turn, that allows an attacker to execute Java code on the server side.

Examples and details of the problem are available in the S2-015 security advisory. Users of the framework are recommended to upgrade to version 2.3.14.3 which is already available to download. The update checks that action names match a regular expression of [a-z]*[A-Z]*[0-9]*[.\-_!/]* (though admins can change the regexp of allowed names through a constant in struts.xml) and the developers have removed the double evaluation from the OgnlTextParser. Coverity, which has published a detailed blog posting on the problem, found the flaw, as it did for the previous one.