CWE-106, Struts: Plug-in Framework not in Use, is the broadest of the Struts validation entries. When an application does not use an input validation framework such as the Struts Validator, MITRE says there is a greater risk of introducing weaknesses related to insufficient input validation.
It is a design level finding. Nothing is wrong with a specific line. The problem is the absence of a consistent mechanism, so every action has to remember to do its own checks.
How it happens
In Struts, the Validator is enabled as a plug-in in the application configuration. If it is never registered, validation configuration files are ignored and form beans are only as safe as the hand written checks inside them.
A team starts a module with ad hoc if statements in each action. Those checks drift, get copied inconsistently, and eventually miss a field. MITRE's own framing: unchecked input is the leading cause of vulnerabilities in J2EE applications, leading to cross-site scripting, process control and SQL injection, among others.
What an attacker gains
MITRE lists the consequence as integrity with an unexpected state. The deeper risk is the one it names in the extended description: the injection classes above, plus a buffer overflow if the Java application interfaces with native code that does not check array bounds.
How to find it
MITRE gives no detection method for this entry, so check the configuration. Look for the Validator plug-in declaration in the Struts configuration and confirm every form mapping is covered. A mapping with no validation rules is a gap, and CWE-108 (Unvalidated Action Form) tracks that one separately.
How to fix it
MITRE recommends using an input validation framework such as Struts and using it to validate all program input before the application processes it. Ensure there are no holes in the configuration of the Validator. Its examples of what to check:
- Phone number fields contain only valid characters in phone numbers.
- Boolean values are only "T" or "F".
- Free-form strings are of a reasonable length and composition.
Make the framework the default. Enable the plug-in, require every form to extend a Validator class, require every field to have a rule, and fail the build or the review if one is missing.
Quick check
Is this a code bug or a design gap?
A design gap. No single line is wrong, but without a framework each action must validate input by hand, and eventually one will not.
