⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.
CVE-2017-5638
Severity
9.8CRITICAL
EPSS
94.3%
top 0.06%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 11
KEV addedNov 3
KEV dueMay 3
Latest updateJul 21
CISA Required Action: Apply updates per vendor instructions.
Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages10 packages
Patches
🔴Vulnerability Details
4💥Exploits & PoCs
3🔍Detection Rules
5Suricata▶
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) (Content-Disposition) M1↗2017-03-20
Suricata
▶
Suricata
▶
Suricata
▶
📋Vendor Advisories
3🕵️Threat Intelligence
9Unit42
▶
Tenable
▶
📄Research Papers
1arXiv▶
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting↗2021-02-10
💬Community
1Bugzilla
▶