CVE-2017-5638 Apache Struts Remote Code Execution
Remote attackers can execute arbitrary commands via crafted HTTP headers in Apache Struts, requiring immediate upgrade to patched versions.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5638?
CVE-2017-5638 is a critical command injection vulnerability in Apache Struts, published on 11 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Weakness: CWE-755
Which versions are affected by CVE-2017-5638?
4 open source packages ship an affected version, including org.apache.struts:struts2-core. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.struts:struts2-core Maven | From 2.3.0 | 2.3.32 |
org.apache.struts:struts2-core Maven | From 2.3.0 | 2.3.32 |
org.apache.struts:struts2-core Maven | From 2.5.0 | 2.5.10.1 |
org.apache.struts:struts2-core Maven | From 2.5.0 | 2.5.10.1 |
Products include Apache Struts, Arubanetworks Clearpass Policy Manager, Hp Server Automation, Ibm Storwize V3500 Firmware, Ibm Storwize V5000 Firmware, Ibm Storwize V7000 Firmware and 3 more.
How do I fix CVE-2017-5638?
Upgrade org.apache.struts:struts2-core to a fixed version for your release line: 2.3.32 or 2.5.10.1. US federal agencies must fix it by 3 May 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-5638 being exploited?
Yes. Attackers have exploited CVE-2017-5638 in the wild since at least 3 Nov 2021, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 87 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-j77q-2qqg-6989.