NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2017-5638

Apache Struts Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Affected products

VendorProductAffected versions
ApacheStruts
from 2.2.3 before 2.3.32
from 2.5.0 before 2.5.10.1
IbmStorwize V3500 Firmware
Versions 7.7.1.6, 7.8.1.0
IbmStorwize V5000 Firmware
Versions 7.7.1.6, 7.8.1.0
IbmStorwize V7000 Firmware
Versions 7.7.1.6, 7.8.1.0
LenovoStorage V5030 Firmware
Versions 7.7.1.6, 7.8.1.0
HpServer Automation
Versions 9.1.0, 10.0.0, 10.1.0, 10.2.0, 10.5.0
OracleWeblogic Server
Versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0
ArubanetworksClearpass Policy Manager
before 6.6.5
NetappOncommand Balance
All versions

Weakness classification

CWE-755

References