vulnwire
8.1high

CVE-2017-9805KEVin critical feed2 exploitsNuclei template

REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

Also known as GHSA-gg9m-fj3v-r58c

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
99.4%
percentile 100%
Public exploits
2
Metasploit · Exploit-DB · Nuclei check

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Apache / Struts
CISA name
Apache Struts Deserialization of Untrusted Data Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

99.40% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.struts:struts2-rest-plugin
>=2.1.1, <2.3.34
>=2.5.0, <2.5.13
2.3.34
2.5.13

Affected products

  • Apache Software Foundation Apache Struts

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • oracle.com /technetwork/security-advisory/alert-cve-2017-9805-3889403.html · x_refsource_CONFIRM, x_transferred
  • struts.apache.org /docs/s2-052.html · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1039263 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/100609 · vdb-entry, x_refsource_BID, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 · vendor-advisory, x_refsource_CISCO, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1488482 · x_refsource_CONFIRM, x_transferred
  • blogs.apache.org /foundation/entry/apache-struts-statement-on-equifax · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/42627/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • lgtm.com /blog/apache_struts_CVE-2017-9805 · x_refsource_MISC, x_transferred
  • cwiki.apache.org /confluence/display/WW/S2-052 · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20170907-0001/ · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/112992 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2017-9805 · advisory
  • github.com /apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26 · web
  • github.com /apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a · web
  • github.com /apache/struts · package
  • security.netapp.com /advisory/ntap-20170907-0001 · web
  • web.archive.org /web/20170909031344/http://www.securityfocus.com/bid/100609 · web
  • web.archive.org /web/20170922053119/http://www.securitytracker.com/id/1039263 · web
  • exploit-db.com /exploits/42627 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.