vulnwire
9.8crit

CVE-2017-5638KEV · ransomwarein critical feed3 exploitsNuclei template

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Also known as GHSA-j77q-2qqg-6989

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
100.0%
percentile 100%
Public exploits
3
Metasploit · Exploit-DB · Nuclei check

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Apache / Struts
CISA name
Apache Struts Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

100.00% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template Apache Struts 2 - Remote Command Execution · nuclei detection template
  • Metasploit exploit/multi/http/struts2_content_type_ognl Apache Struts Jakarta Multipart Parser OGNL Injection · metasploit exploit, excellent rank · 2017-03-07
  • EDB-41614 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit) · remote · 2017-03-15
  • EDB-41570 Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution · webapps · 2017-03-07

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C
GitHub3.010.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.struts:struts2-core
>=2.3.0, <2.3.32
>=2.5.0, <2.5.10.1
2.3.32
2.5.10.1

Affected products

  • Apache Software Foundation Apache Struts

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-20 Improper Input Validation

References

  • nmap.org /nsedoc/scripts/http-vuln-cve2017-5638.html · x_refsource_MISC, x_transferred
  • arubanetworks.com /assets/alert/ARUBA-PSA-2017-002.txt · x_refsource_CONFIRM, x_transferred
  • arstechnica.com /security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/41570 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • security.netapp.com /advisory/ntap-20170310-0001/ · x_refsource_CONFIRM, x_transferred
  • github.com /rapid7/metasploit-framework/issues/8064 · x_refsource_MISC, x_transferred
  • struts.apache.org /docs/s2-046.html · x_refsource_CONFIRM, x_transferred
  • blog.talosintelligence.com /2017/03/apache-0-day-exploited.html · x_refsource_MISC, x_transferred
  • imperva.com /blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2 · x_refsource_MISC, x_transferred
  • h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/834067 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • isc.sans.edu /diary/22169 · x_refsource_MISC, x_transferred
  • struts.apache.org /docs/s2-045.html · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1037973 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • eweek.com /security/apache-struts-vulnerability-under-attack.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/96729 · vdb-entry, x_refsource_BID, x_transferred
  • twitter.com /theog150/status/841146956135124993 · x_refsource_MISC, x_transferred
  • github.com /mazen160/struts-pwn · x_refsource_MISC, x_transferred
  • packetstormsecurity.com /files/141494/S2-45-poc.py.txt · x_refsource_MISC, x_transferred
  • symantec.com /security-center/network-protection-security-advisories/SA145 · x_refsource_CONFIRM, x_transferred
  • support.lenovo.com /us/en/product_security/len-14200 · x_refsource_CONFIRM, x_transferred
  • git1-us-west.apache.org /repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a · x_refsource_CONFIRM, x_transferred
  • h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us · x_refsource_CONFIRM, x_transferred
  • git1-us-west.apache.org /repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 · x_refsource_CONFIRM, x_transferred
  • cwiki.apache.org /confluence/display/WW/S2-045 · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/41614/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cwiki.apache.org /confluence/display/WW/S2-046 · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2017-3236622.html · x_refsource_CONFIRM, x_transferred
  • h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us · x_refsource_CONFIRM, x_transferred
  • blog.trendmicro.com /trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-exe · x_refsource_MISC, x_transferred
  • lists.apache.org /thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apach · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apach · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apach · mailing-list, x_refsource_MLIST, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2017-5638 · advisory
  • github.com /apache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2b · web
  • github.com /apache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519a · web
  • lists.apache.org /thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache. · web
  • lists.apache.org /thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache. · web
  • security.netapp.com /advisory/ntap-20170310-0001 · web
  • web.archive.org /web/20170311203630/http://www.securityfocus.com/bid/96729 · web
  • web.archive.org /web/20170921030226/http://www.securitytracker.com/id/1037973 · web
  • exploit-db.com /exploits/41614 · web
  • imperva.com /blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2 · web
  • arstechnica.com /security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites · web
  • git1-us-west.apache.org /repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a · web
  • git1-us-west.apache.org /repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228 · web
  • github.com /advisories/GHSA-j77q-2qqg-6989 · advisory
  • github.com /apache/struts · package
  • lists.apache.org /thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache. · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.