Deserialization of untrusted data in Apache Struts
Priority CRITICAL 94Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.99396 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed org.apache.struts:struts2-rest-plugin (Maven): 2.3.34, 2.5.13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Struts | Apache Struts before 2.3.34 and 2.5.x before 2.5.13 | — | No fix listed | CNA |
| — | org.apache.struts:struts2-rest-plugin (Maven) | 2.1.1 to before 2.3.34 | 2.3.34 | Patch available | GHSA-gg9m-fj3v-r58c |
| — | org.apache.struts:struts2-rest-plugin (Maven) | 2.5.0 to before 2.5.13 | 2.5.13 | Patch available | GHSA-gg9m-fj3v-r58c |
- Apache Struts VendorApache Affected Apache Struts before 2.3.34 and 2.5.x before 2.5.13 Fixed in — No fix listed CNA
- org.apache.struts:struts2-rest-plugin (Maven) Vendor— Affected 2.1.1 to before 2.3.34 Fixed in 2.3.34 Patch available GHSA-gg9m-fj3v-r58c
- org.apache.struts:struts2-rest-plugin (Maven) Vendor— Affected 2.5.0 to before 2.5.13 Fixed in 2.5.13 Patch available GHSA-gg9m-fj3v-r58c
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* | 2.1.2 to before 2.3.34; 2.5.0 to before 2.5.13 | Vulnerable | Apache |
| cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:* | 10.5(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:* | 11.0(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:* | 11.5(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:* | 11.6(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:* | 3.5.2 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.1.2 to before 2.3.34; 2.5.0 to before 2.5.13 Vulnerable ·Apache
- cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:* Versions 10.5(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:* Versions 11.5(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Cisco
- cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Cisco
- cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
Remediation
- Fix · GHSA-gg9m-fj3v-r58c org.apache.struts:struts2-rest-plugin (Maven) Fixed in 2.3.34 Advisory →
- Fix · GHSA-gg9m-fj3v-r58c org.apache.struts:struts2-rest-plugin (Maven) Fixed in 2.5.13 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Struts — 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017
3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM
Other records, highest priority first
- TI-2017-07184 Improper input validation in Apache StrutsPriority MEDIUM 44
- TI-2017-07173 Improper input validation in Apache StrutsPriority MEDIUM 44
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 5
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat Satellite 5
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2017-9805
- 2026-10-03 Alias added: GHSA-gg9m-fj3v-r58c
References
Exploit 1
Advisory 8
- https://struts.apache.org/docs/s2-052.html
- 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
- https://cwiki.apache.org/confluence/display/WW/S2-052
- https://security.netapp.com/advisory/ntap-20170907-0001/
- VU#112992
- https://nvd.nist.gov/vuln/detail/CVE-2017-9805
Other 9
- https://lgtm.com/blog/apache_struts_CVE-2017-9805
- https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26
- https://github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a
- https://github.com/apache/struts
- https://security.netapp.com/advisory/ntap-20170907-0001
- https://web.archive.org/web/20170909031344/http://www.securityfocus.com/bid/100609
- https://web.archive.org/web/20170922053119/http://www.securitytracker.com/id/1039263
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805
- https://www.exploit-db.com/exploits/42627
More Apache Struts vulnerabilities
- TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
- TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
Sources
- CVE-2017-9805 · CVE Program
- CVE-2017-9805 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-gg9m-fj3v-r58c · GitHub Advisory Database · CC BY 4.0
- CVE-2017-9805 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences