Description
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.0.0 – < 6.4.0 | 6.4.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 18 repositories · most starred shown
-
TAM-K592/CVE-2024-53677-S2-067 ★ 96 · Dec 13, 2024
A critical vulnerability, CVE-2024-53677, has been identified in the popular Apache Struts framework, potentially allowing attackers to execute arbitrary code remotely. This vulnerability arises from…
-
EQSTLab/CVE-2024-53677 ★ 17 · Jan 3, 2025
File upload logic flaw in Apache Struts2 exploit
-
cloudwafs/s2-067-CVE-2024-53677 ★ 9 · Dec 12, 2024
s2-067(CVE-2024-53677)
-
shishirghimir/CVE-2024-53677-Exploit ★ 3 · Feb 24, 2025
-
SeanRickerd/CVE-2024-53677 ★ 3 · Jan 10, 2025
Vulnerable Environment and Exploit for CVE-2024-53677
-
yangyanglo/CVE-2024-53677 ★ 3 · Dec 17, 2024
-
c4oocO/CVE-2024-53677-Docker ★ 3 · Dec 17, 2024
A Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2.
-
r007sec/CVE-2024-53677 ★ 2 · Jun 3, 2025
-
dustblessnotdust/CVE-2024-53677-S2-067-thread ★ 2 · Dec 18, 2024
-
Cythonic1/CVE-2024-53677-POC ★ 1 · Sep 1, 2025
a proof of concept of CVE-2024-53677
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | < 6.4.0 | 6.4.0 | GHSA-43mq-6xmg-29vm |
Advisories 6
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3660 Apache Struts: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 20, 2025
- NCSC-2025-0219 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Jul 9, 2025
- WID-SEC-2025-1479 SAP Patchday Juli 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 7, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0492 Kwetsbaarheid verholpen in Apache Struts NCSC-NL (Netherlands) · Dec 22, 2024
References
- https://cwiki.apache.org/confluence/display/WW/S2-067 vendor-advisory