Vulnerability Details : CVE-2017-9805
Public exploit exists!
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Vulnerability category: Execute code
Products affected by CVE-2017-9805
- cpe:2.3:a:cisco:digital_media_manager:-:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.5\(1\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:hosted_collaboration_solution:10.5\(1\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.0\(1\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:hosted_collaboration_solution:11.6\(1\):*:*:*:*:*:*:*
- cpe:2.3:a:cisco:media_experience_engine:3.5:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:media_experience_engine:3.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:network_performance_analysis:-:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:video_distribution_suite_for_internet_streaming:-:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
CVE-2017-9805 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Apache Struts Deserialization of Untrusted Data Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2017-9805
Added on
2021-11-03
Action due date
2022-05-03
Exploit prediction scoring system (EPSS) score for CVE-2017-9805
97.52%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2017-9805
-
Apache Struts 2 REST Plugin XStream RCE
Disclosure Date: 2017-09-05First seen: 2020-04-26exploit/multi/http/struts2_rest_xstreamApache Struts versions 2.1.2 - 2.3.33 and Struts 2.5 - Struts 2.5.12, using the REST plugin, are vulnerable to a Java deserialization attack in the XStream library. Authors: - Man Yue Mo - wvu <wvu@metasploit.com>
CVSS scores for CVE-2017-9805
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.1
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST | 2024-07-25 |
CWE ids for CVE-2017-9805
-
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-9805
-
https://lgtm.com/blog/apache_struts_CVE-2017-9805
CVE-2017-9805: How QL found a remote code execution vulnerability in Apache Struts | Semmle BlogBroken Link
-
https://security.netapp.com/advisory/ntap-20170907-0001/
CVE-2017-9805 Apache Struts Vulnerability in Multiple NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2
Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017Third Party Advisory
-
https://www.exploit-db.com/exploits/42627/
Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code ExecutionExploit;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/100609
Apache Struts CVE-2017-9805 Remote Code Execution VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
Oracle Security Alert CVE-2017-9805Patch;Third Party Advisory
-
https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax
Apache Struts Statement on Equifax Security Breach : The Apache Software Foundation BlogVendor Advisory
-
https://cwiki.apache.org/confluence/display/WW/S2-052
S2-052 - DEPRECATED: Apache Struts 2 Documentation - Apache Software FoundationMitigation;Vendor Advisory
-
https://struts.apache.org/docs/s2-052.html
S2-052 - DEPRECATED: Apache Struts 2 Documentation - Apache Software FoundationMitigation;Vendor Advisory
-
http://www.securitytracker.com/id/1039263
Apache Struts REST Plugin XStream Deserialization Flaw Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=1488482
1488482 – (CVE-2017-9805) CVE-2017-9805 struts: RCE attack via REST plugin with XStream handler to deserialise XML requestsIssue Tracking;Third Party Advisory;VDB Entry
-
https://www.kb.cert.org/vuls/id/112992
VU#112992 - Apache Struts 2 framework REST plugin insecurely deserializes untrusted XML dataThird Party Advisory;US Government Resource
Jump to