CVE-2017-5638: fallo crítico en Apache Struts
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.8epss 100%
de la publicación al armael mismo día
Publicada en NVD11 mar
1ª PoC7 mar
metasploit7 mar
CISA KEV+1698d
Lo que declaran los fabricantes (VEX)
Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.
Red Hatdocumento VEX ↗
No afectado
1 producto — porque el código vulnerable no está presente en el producto
Red Hat JBoss Fuse Service Works 6
Acción exigida por CISAplazo federal: 2022-05-03
Apply updates per vendor instructions.
En resumen
Apache Struts 2 tiene una falla en cómo maneja las cargas de archivo que permite a atacantes ejecutar comandos maliciosos en un servidor enviando headers HTTP especialmente diseñados. Esta es una vulnerabilidad crítica que fue explotada en ataques reales.
Detalle técnico
El parser Jakarta Multipart en Apache Struts 2 (versiones 2.3.x anteriores a 2.3.32 y 2.5.x anteriores a 2.5.10.1) maneja incorrectamente las excepciones durante el procesamiento de datos multipart, permitiendo ejecución remota de código através de inyección OGNL mediante headers HTTP maliciosos como Content-Type, Content-Disposition o Content-Length. La vulnerabilidad requiere solo acceso de red a un endpoint de la aplicación afectada sin autenticación, resultando en ejecución arbitraria de comandos en el servidor.
Resumen generado y traducido por IA a partir de la descripción oficial.
El análisis completo de esta CVE está disponible en portugués →
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache StrutsPoCs públicas encontradas — 155✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41614exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41570githubgithub.com/mazen160/struts-pwn★ 443githubgithub.com/Flyteas/Struts2-045-Exp★ 61githubgithub.com/immunio/apache-struts2-CVE-2017-5638★ 34githubgithub.com/jas502n/S2-045-EXP-POC-TOOLS★ 25githubgithub.com/PolarisLab/S2-045★ 23githubgithub.com/xsscx/cve-2017-5638★ 22githubgithub.com/jas502n/st2-046-poc★ 21githubgithub.com/ret2jazzy/Struts-Apache-ExploitPack★ 16githubgithub.com/win3zz/CVE-2017-5638★ 16githubgithub.com/jrrdev/cve-2017-5638★ 14githubgithub.com/sUbc0ol/Apache-Struts2-RCE-Exploit-v2-CVE-2017-5638★ 13githubgithub.com/Iletee/struts2-rce★ 11githubgithub.com/tahmed11/strutsy★ 10githubgithub.com/initconf/CVE-2017-5638_struts★ 8githubgithub.com/payatu/CVE-2017-5638★ 8githubgithub.com/0x00-0x00/CVE-2017-5638★ 6githubgithub.com/R4v3nBl4ck/Apache-Struts-2-CVE-2017-5638-Exploit-★ 3githubgithub.com/falcon-lnhg/StrutsShell★ 3githubgithub.com/Nithylesh/web-application-firewall-★ 3githubgithub.com/iampetru/PoC-CVE-2017-5638★ 3githubgithub.com/opt9/Strutscli★ 2githubgithub.com/Greynad/struts2-jakarta-inject★ 2githubgithub.com/andypitcher/check_struts★ 2githubgithub.com/aljazceru/CVE-2017-5638-Apache-Struts2★ 2githubgithub.com/lolwaleet/ExpStruts★ 2githubgithub.com/Kouf320/docker-lab-cve-2017-5638-cve-2021-41773★ 2githubgithub.com/opt9/Strutshock★ 2githubgithub.com/kloutkake/CVE-2017-5638-PoC★ 2githubgithub.com/sighup1/cybersecurity-struts2★ 1githubgithub.com/m3ssap0/struts2_cve-2017-5638★ 1githubgithub.com/jptr218/struts_hack★ 1githubgithub.com/GU-007/struts2-tool★ 1githubgithub.com/un4ckn0wl3z/CVE-2017-5638★ 1githubgithub.com/haxerr9/CVE-2017-5638★ 1githubgithub.com/ludy-dev/XworkStruts-RCE★ 1githubgithub.com/jpacora/Struts2Shell★ 1githubgithub.com/oktavianto/CVE-2017-5638-Apache-Struts2★ 1githubgithub.com/Xernary/CVE-2017-5638-POC★ 1githubgithub.com/Masahiro-Yamada/OgnlContentTypeRejectorValve★ 1githubgithub.com/jongmartinez/CVE-2017-5638★ 1githubgithub.com/riyazwalikar/struts-rce-cve-2017-5638★ 1githubgithub.com/ACharaf06/CVE-2017-5638-Attack-and-Defense★ 1githubgithub.com/ggolawski/struts-rce★ 1githubgithub.com/KarzsGHR/S2-046_S2-045_POC★ 1githubgithub.com/random-robbie/CVE-2017-5638★ 0githubgithub.com/eeehit/CVE-2017-5638★ 0githubgithub.com/NAIRBS/SC3010-Grp-33★ 0githubgithub.com/bongbongco/cve-2017-5638★ 0githubgithub.com/SpiderMate/Stutsfi★ 0githubgithub.com/injcristianrojas/cve-2017-5638★ 0githubgithub.com/QHxDr-dz/CVE-2017-5638★ 0githubgithub.com/Majaktech/apache-struts-cve-2017-5638-project★ 0githubgithub.com/invisiblethreat/strutser★ 0githubgithub.com/sonatype-workshops/struts2-rce★ 0githubgithub.com/mcassano/cve-2017-5638★ 0githubgithub.com/Aasron/Struts2-045-Exp★ 0githubgithub.com/smancke/CVE-2017-5638★ 0githubgithub.com/leandrocamposcardoso/CVE-2017-5638-Mass-Exploit★ 0githubgithub.com/timothyjxhn/DeliberatelyVulnerableWebApp★ 0githubgithub.com/toothbrushsoapflannelbiscuits/cve-2017-5638★ 0githubgithub.com/gsfish/S2-Reaper★ 0githubgithub.com/sUbc0ol/Apache-Struts-CVE-2017-5638-RCE-Mass-Scanner★ 0githubgithub.com/donaldashdown/Common-Vulnerability-and-Exploit★ 0githubgithub.com/kaylertee/Computer-Security-Equifax-2017★ 0githubgithub.com/AIPEACS/SC3010-Computer-Security★ 0githubgithub.com/s1kh/Vulnerability-Analysis-and-Mitigation★ 0githubgithub.com/FozilCV/Apache-Struts2-CVE-2017-5638★ 0githubgithub.com/Dungsocool/CVE-2017-5638★ 0githubgithub.com/homjxi0e/CVE-2017-5638★ 0githubgithub.com/Xhendos/CVE-2017-5638★ 0githubgithub.com/TamiiLambrado/Apache-Struts-CVE-2017-5638-RCE-Mass-Scanner★ 0githubgithub.com/c002/Apache-Struts★ 0githubgithub.com/cafnet/apache-struts-v2-CVE-2017-5638★ 0githubgithub.com/Badbird3/CVE-2017-5638★ 0githubgithub.com/testpilot031/vulnerability_struts-2.3.31★ 0githubgithub.com/readloud/CVE-2017-5638★ 0githubgithub.com/FredBrave/CVE-2017-5638-ApacheStruts2.3.5★ 0githubgithub.com/joidiego/Detection-struts-cve-2017-5638-detector★ 0githubgithub.com/MuhammadAbdullah192/CVE-2017-5638-Remote-Code-Execution-Apache-Struts2-EXPLOITATION★ 0githubgithub.com/btamburi/strutszeiro★ 0githubgithub.com/sjitech/test_struts2_vulnerability_CVE-2017-5638★ 0githubgithub.com/jrrombaldo/CVE-2017-5638★ 0githubgithub.com/colorblindpentester/CVE-2017-5638★ 0githubgithub.com/Tankirat/CVE-2017-5638★ 0githubgithub.com/mfdev-solution/Exploit-CVE-2017-5638★ 0githubgithub.com/soufiane-benchahyd/vulhub-struts2★ 0githubgithub.com/mritunjay-k/CVE-2017-5638★ 0githubgithub.com/Piyush-Tiwatne/struts-patch-gap-auditor★ 0githubgithub.com/Ethel087/CVE-2017-5638-Apache-Struts-Analysis★ 0vulncheckvulncheck.com/xdb/ab1e48aab793no verificadovulncheckvulncheck.com/xdb/5a31e2b88d8bno verificadocve_referenceexploit-db.com/exploits/41570no verificadovulncheckvulncheck.com/xdb/b0439ebbc0c0no verificadovulncheckvulncheck.com/xdb/646a3c0fe320no verificadovulncheckvulncheck.com/xdb/961d20815cd2no verificadovulncheckvulncheck.com/xdb/1aeac5628880no verificadovulncheckvulncheck.com/xdb/5de84d7d0047no verificadovulncheckvulncheck.com/xdb/fb98eda84f5dno verificadovulncheckvulncheck.com/xdb/cf28f48b8a4bno verificadovulncheckvulncheck.com/xdb/5e602d793141no verificadovulncheckvulncheck.com/xdb/9d0f3b1cdffcno verificadovulncheckvulncheck.com/xdb/2372c571d51bno verificadovulncheckvulncheck.com/xdb/3a544bce6facno verificadovulncheckvulncheck.com/xdb/34e73d61d621no verificadovulncheckvulncheck.com/xdb/92c9400dcff7no verificadovulncheckvulncheck.com/xdb/513b57e55c0fno verificadovulncheckvulncheck.com/xdb/b7fcc6ca47d8no verificadovulncheckvulncheck.com/xdb/38dd7dd03007no verificadovulncheckvulncheck.com/xdb/337989a2a577no verificadovulncheckvulncheck.com/xdb/b5c1ab2d5bc5no verificadovulncheckvulncheck.com/xdb/df60c287f1cdno verificadovulncheckvulncheck.com/xdb/1b42cf9134f3no verificadovulncheckvulncheck.com/xdb/5dfed5d68cbcno verificadovulncheckvulncheck.com/xdb/30dc525b1c57no verificadovulncheckvulncheck.com/xdb/a920eeb5ee6ano verificadovulncheckvulncheck.com/xdb/c1e14c928d8dno verificadovulncheckvulncheck.com/xdb/dda5454aa978no verificadovulncheckvulncheck.com/xdb/f47a53762ef3no verificadovulncheckvulncheck.com/xdb/20280d4b350bno verificadovulncheckvulncheck.com/xdb/fd5f95144a75no verificadovulncheckvulncheck.com/xdb/5773e4ea569bno verificadovulncheckvulncheck.com/xdb/c4cfff7455b8no verificadovulncheckvulncheck.com/xdb/0cd00e5128ddno verificadovulncheckvulncheck.com/xdb/9d3cbfdc257fno verificadovulncheckvulncheck.com/xdb/dbca6ea08b41no verificadovulncheckvulncheck.com/xdb/fb291c123615no verificadovulncheckvulncheck.com/xdb/9c7436629672no verificadovulncheckvulncheck.com/xdb/bbdb72777ec9no verificadovulncheckvulncheck.com/xdb/1992a6b42411no verificadovulncheckvulncheck.com/xdb/9b37ededd8acno verificadovulncheckvulncheck.com/xdb/fe25757247c8no verificadovulncheckvulncheck.com/xdb/1e4bb0c90cb0no verificadovulncheckvulncheck.com/xdb/24ab649cd1dano verificadovulncheckvulncheck.com/xdb/9eeabd073ffeno verificadovulncheckvulncheck.com/xdb/f0dd214c0a71no verificadovulncheckvulncheck.com/xdb/fae964aee837no verificadovulncheckvulncheck.com/xdb/5bf0668927e9no verificadovulncheckvulncheck.com/xdb/927ddcc5b795no verificadovulncheckvulncheck.com/xdb/d0691e1ab72cno verificadovulncheckvulncheck.com/xdb/7f001c599f37no verificadovulncheckvulncheck.com/xdb/43a16c730cfdno verificadovulncheckvulncheck.com/xdb/af94773df67eno verificadocve_referencewww.exploit-db.com/exploits/41614/no verificadovulncheckvulncheck.com/xdb/43cd5602564cno verificadovulncheckvulncheck.com/xdb/7609b3e7cb98no verificadovulncheckvulncheck.com/xdb/3c19ff65296ano verificadovulncheckvulncheck.com/xdb/2ee648e8c5abno verificadovulncheckvulncheck.com/xdb/bad29a83176eno verificadovulncheckvulncheck.com/xdb/000c5dcf9e6cno verificadovulncheckvulncheck.com/xdb/dcc67ac85fddno verificadocve_referencepacketstormsecurity.com/files/141494/S2-45-poc.py.txtno verificadovulncheckvulncheck.com/xdb/92284df22d05no verificadovulncheckvulncheck.com/xdb/fecafad12e6cno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Apache Struts
En el mismo producto, de las más peligrosas a las menos.
CVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEVCVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEVCVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEVCVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEVCVE-2017-12611—CVE-2017-12611EPSS 87.1%CVE-2021-31805—Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.EPSS 85.4%
Referencias
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.htmlhttp://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/https://cwiki.apache.org/confluence/display/WW/S2-045https://cwiki.apache.org/confluence/display/WW/S2-046https://exploit-db.com/exploits/41570https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519ahttps://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228https://github.com/mazen160/struts-pwnhttps://github.com/rapid7/metasploit-framework/issues/8064https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us