JVN#82782759
Apache Struts 2 REST Plugin: @StrutsParameter checks do not cover @JsonAnySetter

Overview

Apache Struts 2 REST Plugin provided by The Apache Software Foundation contains an issue that @StrutsParameter authorization does not apply to Jackson @JsonAnySetter members.

Products Affected

• Apache Struts 2 versions 7.2.1 through 7.3.0

Description

The Apache Struts 2 REST plugin includes ParameterAuthorizingModule, which enforces @StrutsParameter restrictions when deserializing JSON or XML request bodies into objects, preventing unauthorized parameters from being assigned. The plugin uses Jackson for deserialization, and Jackson supports the @JsonAnySetter annotation for handling dynamically named properties.

However, ParameterAuthorizingModule does not perform these authorization checks for fields or methods annotated with @JsonAnySetter.

The issue applies only when @StrutsParameter enforcement is enabled (struts.parameters.requireAnnotations=true) and the application itself declares a @JsonAnySetter on an Action or Model class bound from a REST request body.

Impact

The authorization checks provided by @StrutsParameter do not apply to values passed to @JsonAnySetter members, potentially resulting in data tampering.

Solution

Update the software
Update the software to version 7.4.0 or later and enable the check: set struts.rest.anySetter.requireAnnotations=true, and annotate each intended any-setter with @StrutsParameter(allowDynamicKeys = true).
Any-setters without that annotation then no longer receive values.

Apply workaround

• Avoid using the @JsonAnySetter annotation in Action or Model classes that accept parameters from REST requests.
• If the use of @JsonAnySetter is necessary, ensure that values are validated by the application before they are stored.