Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Struts
2.3.x before 2.3.32affected2.5.x before 2.5.10.1affected
References
- https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html ↗
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt ↗
- https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ ↗
- https://exploit-db.com/exploits/41570 ↗
- https://security.netapp.com/advisory/ntap-20170310-0001/ ↗
- https://github.com/rapid7/metasploit-framework/issues/8064 ↗
- https://struts.apache.org/docs/s2-046.html ↗
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html ↗
- https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/ ↗
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us ↗
- https://www.kb.cert.org/vuls/id/834067 ↗
- https://isc.sans.edu/diary/22169 ↗
- https://struts.apache.org/docs/s2-045.html ↗
- http://www.securitytracker.com/id/1037973 ↗
- http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html ↗
- http://www.securityfocus.com/bid/96729 ↗
- https://twitter.com/theog150/status/841146956135124993 ↗
- https://github.com/mazen160/struts-pwn ↗
- https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt ↗
- https://www.symantec.com/security-center/network-protection-security-advisories/SA145 ↗
- https://support.lenovo.com/us/en/product_security/len-14200 ↗
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a ↗
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us ↗
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 ↗
- https://cwiki.apache.org/confluence/display/WW/S2-045 ↗
- https://www.exploit-db.com/exploits/41614/ ↗
- https://cwiki.apache.org/confluence/display/WW/S2-046 ↗
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html ↗
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us ↗
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ ↗
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E ↗
- https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E ↗
- https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638 ↗