apache struts CVE-2017-5638 vulnerability in Apache and Other Products
Published on March 11, 2017

product logo product logo product logo product logo product logo
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Apache Struts Jakarta Multipart parser exception handling vulnerability is part of CISA's list of Known Exploited Vulnerabilities. The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

The following remediation steps are recommended / required by May 3, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2017-5638 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Improper Handling of Exceptional Conditions

The software does not handle or incorrectly handles an exceptional condition.


Products Associated with CVE-2017-5638

You can be notified by stack.watch whenever vulnerabilities like CVE-2017-5638 are published in these products:

Apache Struts
 
HP Server Automation
 
Oracle Weblogic Server
 
Aruba Networks Clearpass Policy Manager
 
NetApp Oncommand Balance
 

What versions are vulnerable to CVE-2017-5638?

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.