Apache Struts2 arbitrary code execution vulnerability

(S2-045, CVE-2017-5638)

Apache Struts is an open source project maintained by the Apache Software Foundation, an open source MVC framework for creating enterprise Java Web applications.

CVE Identifier

CVE-2017-5638

Introduction to Vulnerability

Struts uses Jakarta to resolve file upload requests inappropriate when a remote attacker constructs a malicious Content-Type that could cause remote commands to execute.

In fact, in the default.properties file, struts.multipart.parser value has two options, namely jakarta and pell (another original also has a third choice cos). One of the jakarta parsers is a standard component of the Struts 2 framework. By default jakarta is enabled, so the severity of the vulnerability needs to be addressed.

Affected Software

Struts 2.3.5 – Struts 2.3.31

Struts 2.5 – Struts 2.5.10

How to fix

If you are using a file based on Jakarta to upload the Multipart parser, upgrade to Apache Struts 2.3.32 or 2.5.10.1; or you can also switch to a different implementation file to upload the Multipart parser.

Reference