Very High
CVE-2017-5638
CVE-2017-5638
Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Add Assessment
Technical Analysis
This popped Equifax. Vulnerable versions of Struts are exploitable out of the box, since this was a parser flaw. Make sure this is patched!
Technical Analysis
This CVE made it into US-CERT’s “Top 10” bulletin released in May, 2020 – https://www.us-cert.gov/ncas/alerts/aa20-133a / https://web.archive.org/web/20200512161248/https://www.us-cert.gov/ncas/alerts/aa20-133a
- Vulnerable Products: Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1
- Associated Malware: JexBoss
- Mitigation: Upgrade to Struts 2.3.32 or Struts 2.5.10.1
CVSS V3 Severity and Metrics
General Information
Vendors
- apache,
- arubanetworks,
- hp,
- ibm,
- lenovo,
- netapp,
- oracle
Products
- clearpass policy manager,
- oncommand balance -,
- server automation 10.0.0,
- server automation 10.1.0,
- server automation 10.2.0,
- server automation 10.5.0,
- server automation 9.1.0,
- storage v5030 firmware 7.7.1.6,
- storage v5030 firmware 7.8.1.0,
- storwize v3500 firmware 7.7.1.6,
- storwize v3500 firmware 7.8.1.0,
- storwize v5000 firmware 7.7.1.6,
- storwize v5000 firmware 7.8.1.0,
- storwize v7000 firmware 7.7.1.6,
- storwize v7000 firmware 7.8.1.0,
- struts,
- weblogic server 10.3.6.0.0,
- weblogic server 12.1.3.0.0,
- weblogic server 12.2.1.1.0,
- weblogic server 12.2.1.2.0
Metasploit Modules
Exploited in the Wild
References
Advisory
Miscellaneous
