CVE-2017-5638

Apache Struts Remote Code Execution

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 100.0%

Published11 Mar 2017
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Struts≥ 2.2.3 < 2.3.32 · ≥ 2.5.0 < 2.5.10.1

Arubanetworks Clearpass Policy Manager< 6.6.5

HP Server Automation10.0.0 · 10.1.0 · 10.2.0 · 10.5.0

Netapp Oncommand Balanceall versions

Oracle Weblogic Server10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.1.0 · 12.2.1.2.0

IBM Storwize V3500 Firmware7.7.1.6 · 7.8.1.0

IBM Storwize V5000 Firmware7.7.1.6 · 7.8.1.0

IBM Storwize V7000 Firmware7.7.1.6 · 7.8.1.0

Lenovo Storage V5030 Firmware7.7.1.6 · 7.8.1.0

Remediation

Fixed in

Apache Struts≥ 2.3.32

Arubanetworks Clearpass Policy Manager≥ 6.6.5

Patch & vendor advisories

References

http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlExploitThird Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ExploitThird Party Advisory
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ExploitPress/Media Coverage
https://cwiki.apache.org/confluence/display/WW/S2-045MitigationVendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-046MitigationVendor Advisory
https://exploit-db.com/exploits/41570ExploitThird Party AdvisoryVDB Entry
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519aBroken Link
https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228Broken Link
https://github.com/mazen160/struts-pwnExploit
https://github.com/rapid7/metasploit-framework/issues/8064ExploitIssue Tracking

and 24 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2017-5638 being actively exploited?

Yes. CVE-2017-5638 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021. It has been used in ransomware campaigns.

How severe is CVE-2017-5638?

CVE-2017-5638 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2017-5638?

Affected products include Apache Struts, Arubanetworks Clearpass Policy Manager, HP Server Automation, Netapp Oncommand Balance, Oracle Weblogic Server, and 4 more.

How do I fix CVE-2017-5638?

Upgrade affected software to a fixed version, for example Apache Struts 2.3.32, Arubanetworks Clearpass Policy Manager 6.6.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-5638 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.