CVE-2017-9805 Apache Struts Deserialization of Untrusted Data
Attackers can execute arbitrary code by sending malicious XML payloads to the REST plugin due to unsafe deserialization in Apache Struts.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9805?
CVE-2017-9805 is a high-severity unsafe deserialization vulnerability in Apache Struts, published on 15 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Weakness: CWE-502
Which versions are affected by CVE-2017-9805?
4 open source packages ship an affected version, including org.apache.struts:struts2-rest-plugin. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.struts:struts2-rest-plugin Maven | From 2.1.1 | 2.3.34 |
org.apache.struts:struts2-rest-plugin Maven | From 2.1.1 | 2.3.34 |
org.apache.struts:struts2-rest-plugin Maven | From 2.5.0 | 2.5.13 |
org.apache.struts:struts2-rest-plugin Maven | From 2.5.0 | 2.5.13 |
Products include Apache Struts, Cisco Digital Media Manager, Cisco Hosted Collaboration Solution, Cisco Media Experience Engine, Cisco Network Performance Analysis, Cisco Video Distribution Suite for Internet Streaming and 1 more.
How do I fix CVE-2017-9805?
Upgrade org.apache.struts:struts2-rest-plugin to a fixed version for your release line: 2.3.34 or 2.5.13. US federal agencies must fix it by 3 May 2022.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2017-9805 being exploited?
Yes. Attackers have exploited CVE-2017-9805 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 20 proofs of concept on GitHub.
Other vulnerabilities in Apache Struts
Sources
Also known as GHSA-gg9m-fj3v-r58c.