DEV Community

Cover image for Your Application Was Secure. The Framework Wasn't: Understanding Apache Struts
Arashad Dodhiya
Arashad Dodhiya

Posted on

Your Application Was Secure. The Framework Wasn't: Understanding Apache Struts

#cybersecurity #java #website #devops

Imagine you're building a large web application.

Your team spends months writing code.

You review pull requests.

You fix bugs.

You implement authentication.

You perform testing.

Everything seems secure.

Then one day you discover a problem:

The vulnerability isn't in your code.

It's in the framework underneath it.

And suddenly every application built on top of that framework becomes a potential target.

This is exactly why the Apache Struts vulnerability became one of the most important security incidents in modern web application history.

Building on Top of Someone Else's Work

Most developers don't build applications from scratch.

Imagine constructing an office building.

You don't manufacture:

  • Bricks
  • Windows
  • Doors
  • Elevators

You purchase trusted components and assemble them.

Software development works the same way.

Modern applications depend on:

Frameworks
Libraries
Packages
Dependencies
Open Source Components
Enter fullscreen mode Exit fullscreen mode

These components help teams move faster.

But they also introduce a new challenge:

What happens when a trusted component becomes vulnerable?

What Is Apache Struts?

Apache Struts is a Java web application framework.

Its purpose is to simplify web development.

Instead of building everything manually, developers can rely on Struts for:

Request Handling
Form Processing
Input Validation
Routing
Application Logic
Enter fullscreen mode Exit fullscreen mode

A simplified architecture looks like this:

User
   ↓
Apache Struts
   ↓
Application
   ↓
Database
Enter fullscreen mode Exit fullscreen mode

Every request passes through the framework before reaching the application.

And that's why framework vulnerabilities are so important.

Why Attackers Love Framework Vulnerabilities

Imagine finding a vulnerability in:

Company A's Internal Portal
Enter fullscreen mode Exit fullscreen mode

You affect one organization.

Now imagine finding a vulnerability in:

Apache Struts
Enter fullscreen mode Exit fullscreen mode

Suddenly:

Company A
Company B
Company C
Company D
Enter fullscreen mode Exit fullscreen mode

may all be affected.

One vulnerability.

Thousands of targets.

This is what makes framework exploitation so powerful.

Understanding the Request Journey

Before understanding the vulnerability, we need to understand how requests travel.

A typical request looks like:

Browser
    ↓
Web Server
    ↓
Apache Struts
    ↓
Application Logic
    ↓
Response
Enter fullscreen mode Exit fullscreen mode

Along the way, the request carries information.

For example:

POST /upload

Content-Type: multipart/form-data
Enter fullscreen mode Exit fullscreen mode

This information helps the application understand what the client is sending.

Normally it's harmless.

But sometimes trusted input becomes dangerous.

The Airport Security Analogy

Imagine airport security.

Passengers provide information about their luggage.

Security officers should verify it.

Now imagine a passenger provides:

Luggage Information

Plus Additional Instructions
Enter fullscreen mode Exit fullscreen mode

And instead of ignoring those instructions, airport staff executes them.

The issue isn't the luggage.

The issue is that user-controlled information is being trusted too much.

This is conceptually what happened with Apache Struts.

Understanding Framework Exploitation

Many beginner security topics focus on:

SQL Injection
Cross-Site Scripting
File Upload Vulnerabilities
Enter fullscreen mode Exit fullscreen mode

These usually target application features.

Framework exploitation is different.

Instead of attacking:

The Application
Enter fullscreen mode Exit fullscreen mode

you're attacking:

The Foundation Beneath The Application
Enter fullscreen mode Exit fullscreen mode

That's a much bigger problem.

Because every feature depends on that foundation.

Why Remote Code Execution Matters

Remote Code Execution (RCE) means attackers can make the server execute commands.

Think of the difference between:

Looking Through A Window
Enter fullscreen mode Exit fullscreen mode

and:

Walking Inside The Building
Enter fullscreen mode Exit fullscreen mode

RCE moves attackers significantly closer to the second scenario.

Once code execution becomes possible, the impact can quickly expand.

The Developer Lesson

One of the biggest misconceptions in software development is:

If my code is secure, my application is secure.

Modern applications depend on dozens or hundreds of external components.

Questions developers should ask:

  • Which frameworks am I using?
  • Which versions are deployed?
  • How are dependencies updated?
  • Do we track security advisories?

Security isn't just about your code.

It's also about everything your code depends on.

The DevOps Lesson

Apache Struts teaches an equally important operational lesson:

Dependency Management Is Infrastructure Security

Many organizations focus on:

Servers
Containers
Networking
Monitoring
Enter fullscreen mode Exit fullscreen mode

But forgotten dependencies can become attack paths.

A mature deployment process should answer:

What framework versions are running?
Which applications depend on them?
Which environments remain unpatched?
Enter fullscreen mode Exit fullscreen mode

Without visibility, patching becomes guesswork.

The Equifax Reminder

One reason Apache Struts became famous is its connection to the Equifax breach.

Millions of records were exposed.

The application appeared functional.

The business continued operating.

The vulnerability existed underneath the surface.

And that's often how major incidents happen.

Not because systems stop working.

Because they keep working while remaining vulnerable.

The Bigger Lesson

Apache Struts isn't really a story about Java.

It's a story about trust.

Modern software stacks look like:

Application
    ↓
Framework
    ↓
Libraries
    ↓
Operating System
    ↓
Infrastructure
Enter fullscreen mode Exit fullscreen mode

Every layer trusts the layer below it.

If one layer fails, the impact can travel upward.

That's why secure software development requires visibility across the entire stack.

Common Mistakes

"It's Open Source, So Someone Else Will Fix It"

Someone may fix it.

But you still need to deploy the update.

"Our Code Wasn't Vulnerable"

The framework was.

Attackers don't care where the vulnerability lives.

Only that it exists.

"We'll Patch It Later"

Security incidents often happen during "later."

Key Takeaways

  • Apache Struts is a widely used Java framework.
  • Framework vulnerabilities can affect many organizations simultaneously.
  • Framework exploitation targets shared infrastructure beneath applications.
  • Remote Code Execution is one of the most severe vulnerability classes.
  • Developers must understand dependency risk.
  • DevOps teams should track and manage framework versions.
  • Patch management is a critical security practice.
  • Secure software depends on secure foundations.

Final Thoughts

One reason Apache Struts remains such an important vulnerability to study is that it teaches a lesson far bigger than a single CVE.

Most organizations focus on the application they built.

Attackers often focus on the components the organization inherited.

And sometimes the most dangerous vulnerability isn't in the code you wrote.

It's in the code you trusted.

Top comments (1)

Collapse
 
arashad_dodhiya_0e4bdba5a profile image
Arashad Dodhiya •

Which worries you more:

A vulnerability in your own code?

Or a vulnerability in a framework used by hundreds of applications?😁