CVE-2024-53677
published 2024-12-11CVE-2024-53677: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
78.20%
99.5th percentile
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | >= 2.0.0 < 6.4.0 | 6.4.0 |
| apache_software_foundation | apache_struts | >= 2.0.0 < 6.4.0 | 6.4.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for uploads of JSP webshell files (e.g., exploit.jsp) to directories that should be restricted, as attackers use path traversal via manipulated file upload parameters to place them there. ↗
- →Monitor for HTTP requests accessing newly uploaded JSP files in unexpected directories following a multipart file upload request — this indicates post-exploitation verification of a successful webshell drop. ↗
- →Check Point IPS blade signature 'Java Server Pages Backdoor' can be used to detect exploitation attempts against CVE-2024-53677. ↗
- →Active exploit attempts matching public PoC code are being observed; traffic should be inspected for file upload parameter manipulation enabling path traversal in Apache Struts applications. ↗
- ·Patching to Struts 6.4.0 alone is insufficient — application code must also be rewritten to use the new Action File Upload mechanism; continuing to use the old FileuploadInterceptor-based upload logic leaves the application vulnerable even after upgrading. ↗
- ·The migration to the new file upload mechanism is not backward compatible and requires rewriting actions and interceptors. ↗
- ·Applications not using the legacy FileuploadInterceptor-based file upload logic are not affected by this vulnerability. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red
vulncheck9.5CRITICAL
vendor_redhat9.5CRITICAL
vendor_oracle9.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Struts file upload logic is flawed
ghsa·2024-12-11
CVE-2024-53677 [CRITICAL] CWE-22 Apache Struts file upload logic is flawed
Apache Struts file upload logic is flawed
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .
OSV
Apache Struts file upload logic is flawed
osv·2024-12-11
CVE-2024-53677 [CRITICAL] Apache Struts file upload logic is flawed
Apache Struts file upload logic is flawed
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .
VulnCheck
Apache Struts File Upload Vulnerability
vulncheck·2024·CVSS 9.5
CVE-2024-53677 [CRITICAL] Apache Struts File Upload Vulnerability
Apache Struts File Upload Vulnerability
File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload.
Affected: Apache Struts
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2024-53677; https://isc.sans.edu/diary/Exploit+attempts+inspired+by+recent+Struts2+File+Upload+Vulnerability+CVE202453677+CVE202350164/31520; https://attackerkb.com/topics/YfjepZ70DS/cve-2024-53677; https://dashboard.shadowser
Oracle
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Struts 2) — CVE-2024-53677
vendor_oracle·2025-01-15·CVSS 9.0
CVE-2024-53677 [CRITICAL] Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Struts 2) — CVE-2024-53677
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Apache Struts 2) vulnerability
CVE: CVE-2024-53677
CVSS: 9.0
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Red Hat
struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
vendor_redhat·2024-12-11·CVSS 9.5
CVE-2024-53677 [CRITICAL] CWE-552 struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
A flaw was found in Apache Struts.
Suricata
ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M2 (CVE-2024-53677)
suricata·2024-12-17·CVSS 9.5
CVE-2024-53677 [CRITICAL] ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M2 (CVE-2024-53677)
ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M2 (CVE-2024-53677)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M2 (CVE-2024-53677)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"------"; content:"Boundary"; within:20; content:"|22|top.uploadfilename|22|"; nocase; fast_pattern; pcre:"/^.*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){1,}/Rmi"; reference:cve,2024-53677; classtype:web-application-attack; sid:2058341; rev:1; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2024_12_17, cve CVE_2024_53677, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at
Suricata
ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M1 (CVE-2024-53677)
suricata·2024-12-16·CVSS 9.5
CVE-2024-53677 [CRITICAL] ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M1 (CVE-2024-53677)
ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M1 (CVE-2024-53677)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Apache Struts2 Path Traversal Attempt Inbound M1 (CVE-2024-53677)"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/(?:\x2factionFileUpload|\.action)$/i"; http.request_body; content:"--WebKitFormBoundary"; fast_pattern; content:"|0d 0a|"; pcre:"/^.*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){1,}/Rmi"; reference:cve,2024-53677; classtype:web-application-attack; sid:2058337; rev:2; metadata:affected_product Apache_Struts2, attack_target Server, created_at 2024_12_16, cve CVE_2024_53677, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_seve
No public exploits indexed.
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
Checkpoint
23rd December – Threat Intelligence Report
blogs_checkpoint·2024-12-23
CVE-2024-12692 23rd December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 23rd December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 23rd December, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
The State of Rhode Island has issued a notification that RIBridges, the state’s portal for social services, has suffered a cyber attack and data leak. According to the reports, the breach was likely caused by a ransomware attack, including compromise of personal information of hundreds of thousands of the state’s reside
Qualys
Apache Struts CVE-2024-53677: File Upload Vulnerability, Impact, and Mitigation Strategies | Qualys
blogs_qualys·2024-12-17·CVSS 5.3
CVE-2024-53677 [MEDIUM] Apache Struts CVE-2024-53677: File Upload Vulnerability, Impact, and Mitigation Strategies | Qualys
#### Table of Contents
- Why Apache Struts (CVE-2024-5367) Poses a Serious Risk to Enterprises
- How To Remediate Apache Struts Exploit
- Qualys Solutions For Apache Struts
Apache has announced a critical vulnerability affecting Apache Struts (CVE-2024-53677), a widely used Java-based web application framework. Struts is integral to many enterprise environments due to its robust architecture, extensive data validation capabilities, and seamless integration with other technologies. These qualities make Struts a preferred choice for large-scale, mission-critical applications, heightening the significance of newly discovered security risks.
## Why Apache Struts (CVE-2024-5367) Poses a Serious Risk to Enterprises
The flaw lies in Struts’ file upload mechanism; affected versions include Str
Qualys
Apache Struts CVE-2024-53677: File Upload Vulnerability, Impact, and Mitigation Strategies
blogs_qualys·2024-12-17·CVSS 5.3
CVE-2024-5367 [MEDIUM] Apache Struts CVE-2024-53677: File Upload Vulnerability, Impact, and Mitigation Strategies
## Table of Contents
Why Apache Struts (CVE-2024-5367) Poses a Serious Risk to Enterprises
How To Remediate Apache Struts Exploit
Qualys Solutions For Apache Struts
Apache has announced a critical vulnerability affecting Apache Struts (CVE-2024-53677), a widely used Java-based web application framework. Struts is integral to many enterprise environments due to its robust architecture, extensive data validation capabilities, and seamless integration with other technologies. These qualities make Struts a preferred choice for large-scale, mission-critical applications, heightening the significance of newly discovered security risks.
## Why Apache Struts (CVE-2024-5367) Poses a Serious Risk to Enterprises
The flaw lies in Struts’ file upload mechanism; affected versions include Struts 2.
Bleepingcomputer
New critical Apache Struts flaw exploited to find vulnerable servers
blogs_bleepingcomputer·2024-12-17·CVSS 9.8
CVE-2024-53677 [CRITICAL] New critical Apache Struts flaw exploited to find vulnerable servers
## New critical Apache Struts flaw exploited to find vulnerable servers
## Bill Toulas
A recently patched critical Apache Struts 2 vulnerability tracked as CVE-2024-53677 is actively exploited using public proof-of-concept exploits to find vulnerable devices.
Apache Struts is an open-source framework for building Java-based web applications used by various organizations, including government agencies, e-commerce platforms, financial institutions, and airlines.
Apache publicly disclosed the Struts CVE-2024-53677 flaw (CVSS 4.0 score: 9.5, "critical") six days ago, stating it is a bug in the software's file upload logic, allowing path traversals and the uploading of malicious files that could lead to remote code execution.
It impacts Struts 2.0.0 through 2.3.37 (end-of-life), 2.5.0 thro
Bugzilla
CVE-2024-53677 struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
bugzilla·2024-12-11·CVSS 9.5
CVE-2024-53677 [CRITICAL] CVE-2024-53677 struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
CVE-2024-53677 struts: org.apache.struts: mixing setters for uploaded files and normal fields can allow bypass file upload checks
File upload logic is flawed vulnerability in Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0, which fixes the issue.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Discussion:
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Note: application not using FileUploadInterceptor are safe.
2024-12-11
Published
Exploited in the wild