Rule Definition
Request parameters handled by Struts 2 are effectively treated as OGNL expressions. A possible DOS attacker might craft requests to a Struts 2 based application with extremely long parameter names (Greater than 100). OGNL evaluation of the parameter name then will consume significant CPU cycles, thus promoting the effectiveness of the DOS attack.

Remediation
As of Struts 2.3.4.1, parameter name length is limited to a maximum of 100 characters. This configuration may be customized by providing the newly introduced parameter "paramNameMaxLength" to the ParametersInteceptor configuration. Upgrade to Struts 2.3.4.1 and above.

Violation Code Sample

Sample Code: 

public void testLargeParameterNameWithCustomLimit() throws Exception {
        ParametersInterceptor parametersInterceptor = createParametersInterceptor();
        int limit = 120; //length to be verified if it is less than 100 is not a violation..
//
//If this function setParamNameMaxLength - limit is not set , then violation is it be created.
//if setParamNameMaxLength is not found  also it is a violation.
//
        parametersInterceptor.setParamNameMaxLength(limit);
        doTestParameterNameLengthRestriction(parametersInterceptor, limit);
    }

    private void doTestParameterNameLengthRestriction(ParametersInterceptor parametersInterceptor,
                                                      int paramNameMaxLength) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < paramNameMaxLength + 1; i++) {
            sb.append("x");
        }

        ...
        ...
        ...
        
    }

Fixed Code Sample

Sample Code: 

public void testLargeParameterNameWithCustomLimit() throws Exception {
        ParametersInterceptor parametersInterceptor = createParametersInterceptor();
        int limit = 90; //length to be verified if it is less than 100 is not a violation..
//
//If this function setParamNameMaxLength - limit is not set , then violation is it be created.
//if setParamNameMaxLength is not found  also it is a violation.
// default value is 100 from 2.3.4.1 version onwards and below version there is no defualt value and user //needs to explicitly declare
//
        parametersInterceptor.setParamNameMaxLength(limit);
        doTestParameterNameLengthRestriction(parametersInterceptor, limit);
    }

    private void doTestParameterNameLengthRestriction(ParametersInterceptor parametersInterceptor,
                                                      int paramNameMaxLength) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < paramNameMaxLength + 1; i++) {
            sb.append("x");
        }

        ...
        ...
        ...
        
    }

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4387 https://cwiki.apache.org/confluence/display/WW/S2-011 https://nvd.nist.gov/vuln/detail/CVE-2012-4387 http://cwe.mitre.org/data/definitions/264.html