CVE-2017-5638
KEVRansomware UseApache Struts Remote Code Execution Vulnerability
Description
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedMar 11, 2017
Last modifiedJun 17, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlExploitThird Party Advisory
- blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ExploitThird Party Advisory
- arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txtThird Party Advisory
- eweek.com/security/apache-struts-vulnerability-under-attack.htmlPress/Media CoverageThird Party Advisory
- oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatchThird Party Advisory
- securityfocus.com/bid/96729Broken LinkThird Party Advisory
- securitytracker.com/id/1037973Broken LinkThird Party Advisory
- arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ExploitPress/Media Coverage
- cwiki.apache.org/confluence/display/WW/S2-045MitigationVendor Advisory
- cwiki.apache.org/confluence/display/WW/S2-046MitigationVendor Advisory
- exploit-db.com/exploits/41570ExploitThird Party Advisory
- git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519aBroken Link
0 recent articles mention this CVE
99
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1638 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-755
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.