Improper handling of exceptional conditions in Apache Struts
Priority CRITICAL 100Exploited in the wildCWE-755Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03Known ransomware use
EPSS 0.99999 99th percentileScored 2026-11-07
Public exploit Yes 10 exploit referencesTagged by NVD and the CNA
Fix Fixed Apache Struts (Apache Software Foundation): 2.3.32, 2.5.10.1org.apache.struts:struts2-core (Maven): 2.3.32, 2.5.10.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Struts | 2.3 to before 2.3.32; 2.5 to before 2.5.10.1 | 2.3.32, 2.5.10.1 | Patch available | CNA |
| — | org.apache.struts:struts2-core (Maven) | 2.3.0 to before 2.3.32 | 2.3.32 | Patch available | GHSA-j77q-2qqg-6989 |
| — | org.apache.struts:struts2-core (Maven) | 2.5.0 to before 2.5.10.1 | 2.5.10.1 | Patch available | GHSA-j77q-2qqg-6989 |
- Apache Struts VendorApache Affected 2.3 to before 2.3.32; 2.5 to before 2.5.10.1 Fixed in 2.3.32, 2.5.10.1 Patch available CNA
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.3.0 to before 2.3.32 Fixed in 2.3.32 Patch available GHSA-j77q-2qqg-6989
- org.apache.struts:struts2-core (Maven) Vendor— Affected 2.5.0 to before 2.5.10.1 Fixed in 2.5.10.1 Patch available GHSA-j77q-2qqg-6989
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* | 2.2.3 to before 2.3.32; 2.5.0 to before 2.5.10.1 | Vulnerable | Apache |
| cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:* | 7.7.1.6 | Vulnerable | IBM |
| cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:* | 7.8.1.0 | Vulnerable | IBM |
| cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:* | 7.7.1.6 | Vulnerable | IBM |
| cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:* | 7.8.1.0 | Vulnerable | IBM |
| cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:* | 7.7.1.6 | Vulnerable | IBM |
| cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:* | 7.8.1.0 | Vulnerable | IBM |
| cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.2.3 to before 2.3.32; 2.5.0 to before 2.5.10.1 Vulnerable ·Apache
- cpe:2.3:o:ibm:storwize_v3500_firmware:7.7.1.6:*:*:*:*:*:*:* Versions 7.7.1.6 Vulnerable ·IBM
- cpe:2.3:o:ibm:storwize_v3500_firmware:7.8.1.0:*:*:*:*:*:*:* Versions 7.8.1.0 Vulnerable ·IBM
- cpe:2.3:h:ibm:storwize_v3500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:ibm:storwize_v5000_firmware:7.7.1.6:*:*:*:*:*:*:* Versions 7.7.1.6 Vulnerable ·IBM
- cpe:2.3:o:ibm:storwize_v5000_firmware:7.8.1.0:*:*:*:*:*:*:* Versions 7.8.1.0 Vulnerable ·IBM
- cpe:2.3:h:ibm:storwize_v5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:o:ibm:storwize_v7000_firmware:7.7.1.6:*:*:*:*:*:*:* Versions 7.7.1.6 Vulnerable ·IBM
- cpe:2.3:o:ibm:storwize_v7000_firmware:7.8.1.0:*:*:*:*:*:*:* Versions 7.8.1.0 Vulnerable ·IBM
- cpe:2.3:h:ibm:storwize_v7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:* | 7.7.1.6 | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:* | 7.8.1.0 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:storage_v5030:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:* | 10.0.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:* | 10.1.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:* | 10.2.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:* | 10.5.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* | 10.3.6.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:* | 12.2.1.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:* | 12.2.1.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* | before 6.6.5 | Vulnerable | Arubanetworks |
| cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:o:lenovo:storage_v5030_firmware:7.7.1.6:*:*:*:*:*:*:* Versions 7.7.1.6 Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:storage_v5030_firmware:7.8.1.0:*:*:*:*:*:*:* Versions 7.8.1.0 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:storage_v5030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:a:hp:server_automation:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:server_automation:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:server_automation:10.1.0:*:*:*:*:*:*:* Versions 10.1.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:server_automation:10.2.0:*:*:*:*:*:*:* Versions 10.2.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:server_automation:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:* Versions 12.2.1.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:* Versions 12.2.1.2.0 Vulnerable ·Oracle
- cpe:2.3:a:arubanetworks:clearpass_policy_manager:*:*:*:*:*:*:*:* Versions before 6.6.5 Vulnerable ·Arubanetworks
- cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Apache Struts (Apache Software Foundation) Fixed in 2.3.32, 2.5.10.1
- Fix · GHSA-j77q-2qqg-6989 org.apache.struts:struts2-core (Maven) Fixed in 2.3.32 Advisory →
- Fix · GHSA-j77q-2qqg-6989 org.apache.struts:struts2-core (Maven) Fixed in 2.5.10.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat JBoss Fuse Service Works 6
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2017-5638
- 2026-10-03 Alias added: GHSA-j77q-2qqg-6989
References
Exploit 10
- https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
- https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
- 41570
- https://github.com/rapid7/metasploit-framework/issues/8064
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
- https://isc.sans.edu/diary/22169
- https://github.com/mazen160/struts-pwn
- https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
- 41614
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
Advisory 15
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
- https://security.netapp.com/advisory/ntap-20170310-0001/
- https://struts.apache.org/docs/s2-046.html
- https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/
- VU#834067
- https://struts.apache.org/docs/s2-045.html
- http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
- https://twitter.com/theog150/status/841146956135124993
- https://support.lenovo.com/us/en/product_security/len-14200
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
- https://cwiki.apache.org/confluence/display/WW/S2-045
- https://cwiki.apache.org/confluence/display/WW/S2-046
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us
- https://nvd.nist.gov/vuln/detail/CVE-2017-5638
- https://github.com/advisories/GHSA-j77q-2qqg-6989
Other 23
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us
- https://www.symantec.com/security-center/network-protection-security-advisories/SA145
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228
- [announce] 20200131 Apache Software Foundation Security Report: 2019
- [announce] 20210125 Apache Software Foundation Security Report: 2020
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020
- https://github.com/apache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2b
- https://github.com/apache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519a
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E
- https://security.netapp.com/advisory/ntap-20170310-0001
- https://web.archive.org/web/20170311203630/http://www.securityfocus.com/bid/96729
- https://web.archive.org/web/20170921030226/http://www.securitytracker.com/id/1037973
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638
- https://www.exploit-db.com/exploits/41614
- https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2
- https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites
- https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a
- https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228
- https://github.com/apache/struts
- https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution
More Apache Struts vulnerabilities
- TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
- TI-2017-07185 Deserialization of untrusted data in Apache Struts KEVCVSS 3.1HIGH 8.1
Sources
- CVE-2017-5638 · CVE Program
- CVE-2017-5638 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-j77q-2qqg-6989 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5638 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences