Deserialization in Apache Struts
CVE-2017-9805
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when dese…
Vulnerability class: Insecure Deserialization
EPSS: 0.995 (99.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Struts
- Apache Software Foundation Struts — versions Apache Struts before 2.3.34 and 2.5.x before 2.5.13
- Cisco Digital_media_manager
- Cisco Hosted_collaboration_solution — versions 10.5\(1\), 11.0\(1\), 11.5\(1\)
- Cisco Media_experience_engine — versions 3.5, 3.5.2
- Cisco Network_performance_analysis
- Cisco Video_distribution_suite_for_internet_streaming
- Netapp Oncommand_balance
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
- mazen160/struts-pwn_CVE-2017-9805
- luc10/struts-rce-cve-2017-9805
- chrisjd20/cve-2017-9805.py
- 0x00-0x00/-CVE-2017-9805
- Lone-Ranger/apache-struts-pwn_CVE-2017-9805
- Shakun8/CVE-2017-9805
- hahwul/struts2-rce-cve-2017-9805-ruby
- 0xd3vil/CVE-2017-9805-Exploit
- jongmartinez/-CVE-2017-9805-
- UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-
References
- security@apache.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security@apache.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- security@apache.org (x_refsource_CISCO, vendor-advisory, Third Party Advisory)
- security@apache.org (x_refsource_CONFIRM, VDB Entry, Third Party Advisory, Issue Tracking)
- security@apache.org (x_refsource_CONFIRM, Vendor Advisory)
- security@apache.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
- security@apache.org (x_refsource_MISC, Broken Link)
- security@apache.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-9805?
- CVE-2017-9805 is a high-severity vulnerability in Apache Struts, classified under Deserialization of Untrusted Data. CVSS score: 8.1/10. Published 2017-09-15.
- How severe is CVE-2017-9805?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2017-9805 known to be exploited?
- Yes. CVE-2017-9805 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 159 public proof-of-concept repositories are indexed.