How to reproduce the security issue CVE-2014-0094. I googled but couldn't able to find any reference to the same.
Got it working.
I have to enable logging (for ognl package) to see the error.
Pass in parameter like class.classLoader.resource.dircontext.docBase=someText to the struts2 application.
localhost:8080/sampleApp/showlogin.do?class.classLoader.resource.diretext.docBase=someText
Then in the log I would see something like this.
java.lang.IllegalArgumentException: Document base base does not exist or is not a readable directory
at org.apache.naming.resources.FileDirContext.setDocBase(FileDirContext.java:136)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
After applying the workaround then I don't see above error in the log.
Reference: http://www.brentron.com/safe/web/9248.html http://isayan.cocolog-nifty.com/diary/2014/04/s2-020.html