Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.3.x before 2.3.32, 2.5.x before 2.5.10.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Struts Jakarta Multipart Parser OGNL Injection
exploit/multi/http/struts2_content_type_ognl
Exploit-DB 2
- Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit) EDB-41614 · remote · Mar 15, 2017 · verified
- Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution EDB-41570 · webapps · Mar 7, 2017 · verified
GitHub 87 repositories · most starred shown
-
mazen160/struts-pwn ★ 445 · Mar 12, 2017
An exploit for Apache Struts CVE-2017-5638
-
Flyteas/Struts2-045-Exp ★ 61 · Mar 7, 2017
Struts2 S2-045（CVE-2017-5638）Exp with GUI
-
immunio/apache-struts2-CVE-2017-5638 ★ 34 · Mar 10, 2017
Demo Application and Exploit
-
jas502n/S2-045-EXP-POC-TOOLS ★ 25 · Mar 9, 2017
S2-045 漏洞 POC-TOOLS CVE-2017-5638
-
PolarisLab/S2-045 ★ 23 · Mar 7, 2017
Struts2 S2-045（CVE-2017-5638）Vulnerability environment - http://www.mottoin.com/97954.html
-
xsscx/cve-2017-5638 ★ 22 · Mar 10, 2017
Example PoC Code for CVE-2017-5638 | Apache Struts Exploit
-
jas502n/st2-046-poc ★ 21 · Mar 21, 2017
st2-046-poc CVE-2017-5638
-
win3zz/CVE-2017-5638 ★ 16 · May 13, 2018
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution - Shell Script
-
ret2jazzy/Struts-Apache-ExploitPack ★ 16 · Mar 12, 2017
These are just some script which you can use to detect and exploit the Apache Struts Vulnerability (CVE-2017-5638)
-
jrrdev/cve-2017-5638 ★ 14 · Mar 15, 2017
cve-2017-5638 Vulnerable site sample
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Struts 2 - Remote Command Execution http/cves/2017/CVE-2017-5638.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.3.0, < 2.3.32 | 2.3.32 | GHSA-j77q-2qqg-6989 |
| Maven | org.apache.struts:struts2-core | >= 2.5.0, < 2.5.10.1 | 2.5.10.1 | GHSA-j77q-2qqg-6989 |
Advisories 2
- WID-SEC-2024-1277 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- WID-SEC-2023-0461 Apache Struts: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Feb 22, 2023
References
- https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
- https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
- 41570 exploit
- https://security.netapp.com/advisory/ntap-20170310-0001/
- https://github.com/rapid7/metasploit-framework/issues/8064
- https://struts.apache.org/docs/s2-046.html
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
- https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us
- VU#834067 third-party-advisory
- https://isc.sans.edu/diary/22169
- https://struts.apache.org/docs/s2-045.html
- 1037973 vdb-entry
- http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
- 96729 vdb-entry
- https://twitter.com/theog150/status/841146956135124993
- https://github.com/mazen160/struts-pwn
- https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
- https://www.symantec.com/security-center/network-protection-security-advisories/SA145
- https://support.lenovo.com/us/en/product_security/len-14200
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228
- https://cwiki.apache.org/confluence/display/WW/S2-045
- 41614 exploit
- https://cwiki.apache.org/confluence/display/WW/S2-046
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list
- [announce] 20210125 Apache Software Foundation Security Report: 2020 mailing-list
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020 mailing-list