CWE-109, Struts: Validator Turned Off, covers a Struts action form mapping where automatic filtering has been switched off. MITRE says this disables the Struts Validator and custom validation logic, exposing the application to other weaknesses related to insufficient input validation.
How it happens
The switch is the validate attribute on an action mapping.
<!-- Vulnerable: validation disabled for this action -->
<action path="/search" type="app.SearchAction"
name="searchForm" validate="false"/>
People turn it off for understandable reasons: a form that fails validation during development, a multi step wizard, a quick workaround that was never reverted. The setting stays and the check never returns.
What an attacker gains
MITRE lists a bypass of a protection mechanism. Every form behind that mapping receives raw input, so anything the validation configuration would have rejected now reaches your action code.
How to find it
MITRE lists no detection methods for this entry. Search the Struts configuration for validate="false" and review each hit. For each one, ask whether another layer validates the input and whether the reason for disabling it still holds.
How to fix it
MITRE's fix: ensure that an action form mapping enables validation by setting the validate field to true.
<action path="/search" type="app.SearchAction"
name="searchForm" validate="true"/>
If a multi step flow needs partial validation, validate each step with its own rules rather than turning checks off.
Quick check
Where do you look for this weakness?
In the action mappings of the Struts configuration, for any mapping where validate is false.
