Struts2 Remote Code Execution Vulnerability (S2-013) temporary solution

Struts2 has the remote code execution vulnerability again. For details, see 《Struts2 Remote Code Execution Vulnerability Analysis (S2-013)"
The following is a temporary solution provided by the LH Team:
Modify the file: org. apache. struts2.views. util. DefaultUrlHelper lines 281-284:

Private String translateVariable (String input ){

ValueStack valueStack = ServletActionContext. getContext (). getValueStack ();

Return TextParseUtil. translateVariables (input, valueStack );

}

Modify

Private String translateVariable (String input ){

Return input;

}

 

Note: Please pay attention to the latest official updates and patch releases.