Log in Start free

Actively exploited · Published Sep 15, 2017 · Assigned by apache

CVE-2017-9805

High 8.1 Exploited

In plain English

A high-severity unsafe deserialization in Apache Struts from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 99.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)99.4%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.struts:struts2-rest-plugin2.3.34GHSA-gg9m-fj3v-r58c
Mavenorg.apache.struts:struts2-rest-plugin2.5.13GHSA-gg9m-fj3v-r58c

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Struts Apache Struts before 2.3.34 and 2.5.x before 2.5.13

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References