What’s Vulnerable › Vulnerabilities

CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-11 · updated 2026-06-17
• Weakness: CWE-755

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Affected products

• Apache Struts: from 2.2.3 before 2.3.32; from 2.5.0 before 2.5.10.1 — fixed in 2.3.32, 2.5.10.1
• Aruba ClearPass Policy Manager: before 6.6.5 — fixed in 6.6.5
• HP Server Automation: 9.1.0, 10.0.0, 10.1.0, 10.2.0, 10.5.0
• IBM Storwize V3500 Firmware: 7.7.1.6, 7.8.1.0
• IBM Storwize V5000 Firmware: 7.7.1.6, 7.8.1.0
• IBM Storwize V7000 Firmware: 7.7.1.6, 7.8.1.0
• Lenovo Storage V5030 Firmware: 7.7.1.6, 7.8.1.0
• NetApp Oncommand Balance: all versions
• Oracle WebLogic Server: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0

How to fix

Upgrade to a fixed version: Apache Struts 2.3.32, 2.5.10.1; Aruba ClearPass Policy Manager 6.6.5. Check the vendor advisory for mitigations.

References

• http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
• http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
• http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.securityfocus.com/bid/96729
• http://www.securitytracker.com/id/1037973
• https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/
• https://cwiki.apache.org/confluence/display/WW/S2-045
• https://cwiki.apache.org/confluence/display/WW/S2-046
• https://exploit-db.com/exploits/41570
• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a

Get alerted when CVE-2017-5638 or the next vulnerability affects your stack