Protection from Struts Remote Code Execution Vulnerability (S2-057)

This post details Cloudflare's immediate mitigation of the Apache Struts S2-057 vulnerability using its Web Application Firewall (WAF). It explains the nature of OGNL expressions used in Struts RCE payloads and how S2-057 differs from previous vulnerabilities by allowing payloads in the 'namespace' parameter. Cloudflare's WAF already had rules to protect against OGNL expressions and specific Struts exploit vectors, enabling them to deploy a mitigation within hours of the vulnerability's disclosure. The post also shares observed attack patterns, noting that many were probing attempts rather than malicious actions.