CVE-2017-5638

Vulnerability Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlExploitThird Party Advisory
• http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-ExploitThird Party Advisory
• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txtThird Party Advisory
• http://www.eweek.com/security/apache-struts-vulnerability-under-attack.htmlPress/Media CoverageThird Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatchThird Party Advisory
• http://www.securityfocus.com/bid/96729Broken LinkThird Party AdvisoryVDB Entry
• http://www.securitytracker.com/id/1037973Broken LinkThird Party AdvisoryVDB Entry
• https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-atExploitPress/Media Coverage
• https://cwiki.apache.org/confluence/display/WW/S2-045MitigationVendor Advisory
• https://cwiki.apache.org/confluence/display/WW/S2-046MitigationVendor Advisory
• https://exploit-db.com/exploits/41570ExploitThird Party AdvisoryVDB Entry
• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=3523064939Broken Link
• https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47Broken Link
• https://github.com/mazen160/struts-pwnExploit
• https://github.com/rapid7/metasploit-framework/issues/8064ExploitIssue Tracking