CVE-2017-9791 Apache Struts 1 Improper Input Validation
Remote attackers can execute arbitrary code via malicious field values in Apache Struts 1 plugin messages, requiring immediate upgrades.
- Exploited in the wild
- Since 10 Feb 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9791?
CVE-2017-9791 is a critical code injection vulnerability in Apache Struts, published on 10 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Weakness: CWE-20
Which versions are affected by CVE-2017-9791?
2 open source packages ship an affected version, including org.apache.struts:struts2-struts1-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.struts:struts2-struts1-plugin Maven | All versions to 2.3.37 | None |
org.apache.struts:struts2-struts1-plugin Maven | All versions to 2.3.37 | None |
Products include Apache Struts.
How do I fix CVE-2017-9791?
No fix has been published for CVE-2017-9791 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-9791 being exploited?
Yes. Attackers have exploited CVE-2017-9791 in the wild since at least 10 Feb 2022.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-29rm-6752-gvwv.