CVE-2025-54656 Overview
CVE-2025-54656 is an Improper Output Neutralization for Logs vulnerability [CWE-117] affecting Apache Struts Extras versions before 2. The flaw exists in the LookupDispatchAction component, which writes untrusted input to log files without filtering control characters or newlines. Attackers can craft input that inserts forged log entries, misleading human analysts and automated log parsers. Apache has marked the project as retired and will not release a patched version. The maintainer recommends migrating to a supported alternative or restricting access to trusted users. This vulnerability only affects products no longer supported by the maintainer, which increases the operational risk for organizations still running Struts Extras in production.
Critical Impact
Attackers can inject falsified log entries into Struts Extras logs, undermining forensic integrity and enabling downstream log-parser confusion or masking of malicious activity.
Affected Products
- Apache Struts Extras, all versions before 2
- Applications using LookupDispatchAction from Struts Extras
- Deployments of the retired Struts Extras library that receive untrusted user input
Discovery Timeline
- 2025-07-30 - CVE CVE-2025-54656 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54656
Vulnerability Analysis
The vulnerability resides in how Apache Struts Extras handles logging within LookupDispatchAction. When the framework logs request parameters or dispatch keys sourced from HTTP input, it does not sanitize newline characters (\n, \r) or other control sequences before writing them to log output. An attacker submits input containing embedded line terminators followed by a fabricated log message. The logging subsystem writes this input verbatim, causing the payload to appear as an additional, legitimate log line.
This class of flaw is tracked under [CWE-117: Improper Output Neutralization for Logs]. It does not lead to code execution or memory corruption. Its impact is confined to log integrity, but that impact is significant in environments where log data feeds SIEMs, SOAR playbooks, or compliance evidence.
Root Cause
The root cause is missing output encoding for log sinks. Struts Extras passes untrusted request data directly into logger calls without applying character filtering. Because the project is retired, the maintainer will not publish a fix.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker submits an HTTP request containing embedded CRLF sequences and a synthetic log line to a Struts Extras endpoint using LookupDispatchAction. The forged content is written to log files as if it originated from the application. Automated consumers parsing those logs can be tricked into recording false events, suppressing alerts, or attributing malicious activity to unrelated actors.
No public exploit or proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-54656
Indicators of Compromise
- Log entries containing unexpected CRLF sequences, embedded timestamps, or duplicated log level tokens within a single request context
- Repeated LookupDispatchAction invocations from a single source with anomalously long parameter values
- Log lines that appear structurally valid but reference actions or users not present in application state
Detection Strategies
- Parse application logs with strict regular expressions that flag embedded newline characters inside expected single-line fields
- Correlate web-server access logs with Struts Extras application logs to identify inconsistencies in event counts or sequences
- Deploy log-forwarding pipelines that reject or quote-escape non-printable characters before ingestion into the SIEM
Monitoring Recommendations
- Enable ingestion of Struts Extras logs into a centralized analytics platform with schema validation
- Alert on log entries whose raw byte length or newline count exceeds baseline thresholds for the endpoint
- Track outbound requests to LookupDispatchAction handlers and inspect parameters for %0A, %0D, and Unicode line separators
How to Mitigate CVE-2025-54656
Immediate Actions Required
- Inventory all applications that depend on Apache Struts Extras and identify use of LookupDispatchAction
- Restrict network access to affected applications so only trusted, authenticated users can reach the vulnerable endpoints
- Add a web application firewall rule that strips or rejects requests containing CRLF sequences in query parameters and form fields
- Plan migration away from Struts Extras, which is retired and will receive no further security updates
Patch Information
No patch is available. Apache has retired the Struts Extras project and stated it will not release a fix. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Discussion for maintainer guidance. Migrate to a supported web framework or an actively maintained Struts release.
Workarounds
- Wrap all logger calls that consume request data with a sanitizer that replaces \r and \n with literal escape sequences
- Enforce structured logging (JSON) so that log consumers parse field boundaries instead of relying on line delimiters
- Place affected applications behind an authenticated reverse proxy that limits exposure to internal, trusted users only
# Example WAF rule fragment to drop CRLF injection attempts targeting Struts Extras
SecRule ARGS "@rx (?:%0[aAdD]|\r|\n)" \
"id:1005465,phase:2,deny,status:400,\
msg:'CRLF sequence in request parameter - CVE-2025-54656'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
