CVE-2024-53677
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable path traversal and under some circumstances upload a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts from 2.0.0 before 6.4.0.
Risk Assessment
An attacker could remotely execute arbitrary code on the application server, leading to full system compromise and impact on confidentiality, integrity, and availability.
Recommendation
Upgrade Apache Struts to version 6.4.0 at least and migrate to the new file upload mechanism. If you are not using the old file upload logic based on FileuploadInterceptor, your application is safe.
Other vulnerabilities in Apache Struts
See all- CVE-2016-3090High
The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.
- CVE-2016-4461High
Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2017-9804High
In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.
- CVE-2015-5209High
Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.
- CVE-2017-9787High
Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.
- CVE-2016-4433High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
- CVE-2016-4431High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
- CVE-2016-4430High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
- CVE-2016-0785High
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2015-1831High
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.
Original NVD description (English source)
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Vulnerability data from NVD (NIST) · CISA KEV · EPSS