CVE-2017-5638

CVE-2017-5638 is a critical-severity (CVSS 9.8) vulnerability in Apache Struts. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
• http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt
• http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.securityfocus.com/bid/96729
• http://www.securitytracker.com/id/1037973
• https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/