Log in Start free

Actively exploited · Published Mar 11, 2017 · Assigned by apache

CVE-2017-5638

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity security flaw in Apache Struts from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.struts:struts2-core2.3.32GHSA-j77q-2qqg-6989
Mavenorg.apache.struts:struts2-core2.5.10.1GHSA-j77q-2qqg-6989

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Struts 2.3.x before 2.3.322.5.x before 2.5.10.1

Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References