Known exploited vulnerability
CVE-2017-5638
The short answer
CVE-2017-5638 affects Apache Software Foundation Apache Struts and is rated critical (CVSS 9.8). CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03: attackers are using it, so patch it first. Fixed versions are published for struts2-core (2.3.32, 2.5.10.1).
What it is
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Weakness: CWE-755.
Severity
9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since Nov 3, 2021
Federal due date May 3, 2022
EPSS, next 30 days
100%
Higher than 100% of scored CVEs
How it can be exploited
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
Apply updates per vendor instructions.
Affected packages and fixed versions
| Package | Ecosystem | Fixed in | Advisory |
|---|---|---|---|
| org.apache.struts:struts2-core | Maven | 2.3.32, 2.5.10.1 | GHSA-j77q-2qqg-6989 |
Is it in your code? Drop your lockfile into the free vulnerability check, or let vulnerability watch check your repository every day and open the upgrade as a pull request.
Affected products
Apache Struts. NVD's record lists the exact affected versions.
References
- arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ ExploitPress/Media Coverage
- cwiki.apache.org/confluence/display/WW/S2-045 MitigationVendor Advisory
- cwiki.apache.org/confluence/display/WW/S2-046 MitigationVendor Advisory
- exploit-db.com/exploits/41570 ExploitThird Party AdvisoryVDB Entry
- git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a Broken Link
- git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 Broken Link
- github.com/mazen160/struts-pwn Exploit
- github.com/rapid7/metasploit-framework/issues/8064 ExploitIssue Tracking
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us Broken Link
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us Third Party Advisory
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us Third Party Advisory
- isc.sans.edu/diary/22169 ExploitThird Party Advisory
Questions
Is CVE-2017-5638 being exploited?
Yes. CISA added CVE-2017-5638 to its Known Exploited Vulnerabilities catalog on 2021-11-03, with a federal remediation due date of 2022-05-03. CISA lists it as used in ransomware campaigns.
How do I fix CVE-2017-5638?
Upgrade to a fixed version: org.apache.struts:struts2-core (Maven) 2.3.32 or 2.5.10.1. CISA's required action: Apply updates per vendor instructions.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Apache exploited vulnerabilities
Everything CISA lists as exploited for Apache.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.