Page History

...

By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below

http://localhost:8080/struts2-blank/home.action!login:cantLogin^{Image Removed}<script>alert(document.cookie)</script>=some_value

...