CVE-2017-5638

Vulnerability overview

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Severity and scoring

CVSS score

9.8 · CRITICAL

CVSS version

3.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-755

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Listed in CISA’s Known Exploited Vulnerabilities catalog.

Affected product

Apache · Struts

Added to catalog

2021-11-03

Required action

Apply updates per vendor instructions.

CISA remediation due date

2022-05-03

CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

  From (inclusive): 2.2.3

  Before (exclusive): 2.3.32

• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*

  From (inclusive): 2.5.0

  Before (exclusive): 2.5.10.1

• cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:*

• cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:*

• cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:*

• cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:*

• cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:*

• cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:*

• cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:*

• cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:*

• cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:*

• cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*

• cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:*

  Before (exclusive): 6.6.5

• cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

• http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html

  Exploit · Third Party Advisory

• http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/

  Exploit · Third Party Advisory

• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt

  Third Party Advisory

• http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html

  Press/Media Coverage · Third Party Advisory

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

  Patch · Third Party Advisory

• http://www.securityfocus.com/bid/96729

  Broken Link · Third Party Advisory · VDB Entry

• http://www.securitytracker.com/id/1037973

  Broken Link · Third Party Advisory · VDB Entry

• https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/

  Exploit · Press/Media Coverage

• https://cwiki.apache.org/confluence/display/WW/S2-045

  Mitigation · Vendor Advisory

• https://cwiki.apache.org/confluence/display/WW/S2-046

  Mitigation · Vendor Advisory

• https://exploit-db.com/exploits/41570

  Exploit · Third Party Advisory · VDB Entry

• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a

  Broken Link

• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228

  Broken Link

• https://github.com/mazen160/struts-pwn

  Exploit

• https://github.com/rapid7/metasploit-framework/issues/8064

  Exploit · Issue Tracking

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us

  Broken Link

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us

  Third Party Advisory

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us

  Third Party Advisory

• https://isc.sans.edu/diary/22169

  Exploit · Third Party Advisory

• https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E

  Mailing List

• https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html

  Exploit · Third Party Advisory

• https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt

  Broken Link · Exploit · Third Party Advisory · VDB Entry

• https://security.netapp.com/advisory/ntap-20170310-0001/

  Third Party Advisory

• https://struts.apache.org/docs/s2-045.html

  Mitigation · Vendor Advisory

• https://struts.apache.org/docs/s2-046.html

  Mitigation · Vendor Advisory

• https://support.lenovo.com/us/en/product_security/len-14200

  Third Party Advisory

• https://twitter.com/theog150/status/841146956135124993

  Broken Link · Third Party Advisory

• https://www.exploit-db.com/exploits/41614/

  Exploit · Third Party Advisory · VDB Entry

• https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/

  Third Party Advisory

• https://www.kb.cert.org/vuls/id/834067

  Third Party Advisory · US Government Resource

• https://www.symantec.com/security-center/network-protection-security-advisories/SA145

  Broken Link

• http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html

  Exploit · Third Party Advisory

• http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/

  Exploit · Third Party Advisory

• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt

  Third Party Advisory

• http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html

  Press/Media Coverage · Third Party Advisory

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

  Patch · Third Party Advisory

• http://www.securityfocus.com/bid/96729

  Broken Link · Third Party Advisory · VDB Entry

• http://www.securitytracker.com/id/1037973

  Broken Link · Third Party Advisory · VDB Entry

• https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/

  Exploit · Press/Media Coverage

• https://cwiki.apache.org/confluence/display/WW/S2-045

  Mitigation · Vendor Advisory

• https://cwiki.apache.org/confluence/display/WW/S2-046

  Mitigation · Vendor Advisory

• https://exploit-db.com/exploits/41570

  Exploit · Third Party Advisory · VDB Entry

• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a

  Broken Link

• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228

  Broken Link

• https://github.com/mazen160/struts-pwn

  Exploit

• https://github.com/rapid7/metasploit-framework/issues/8064

  Exploit · Issue Tracking

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us

  Broken Link

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us

  Third Party Advisory

• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us

  Third Party Advisory

• https://isc.sans.edu/diary/22169

  Exploit · Third Party Advisory

• https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E

  Mailing List

• https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html

  Exploit · Third Party Advisory

• https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt

  Broken Link · Exploit · Third Party Advisory · VDB Entry

• https://security.netapp.com/advisory/ntap-20170310-0001/

  Third Party Advisory

• https://struts.apache.org/docs/s2-045.html

  Mitigation · Vendor Advisory

• https://struts.apache.org/docs/s2-046.html

  Mitigation · Vendor Advisory

• https://support.lenovo.com/us/en/product_security/len-14200

  Third Party Advisory

• https://twitter.com/theog150/status/841146956135124993

  Broken Link · Third Party Advisory

• https://www.exploit-db.com/exploits/41614/

  Exploit · Third Party Advisory · VDB Entry

• https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/

  Third Party Advisory

• https://www.kb.cert.org/vuls/id/834067

  Third Party Advisory · US Government Resource

• https://www.symantec.com/security-center/network-protection-security-advisories/SA145

  Broken Link

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638

  US Government Resource

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence