PT-2017-2796 · Apache · Apache Struts

Icez + 2 · Publicado 2017-07-10 · Atualizado 2025-09-22 · CVE-2017-9791

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.x through 2.3.x

Description The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a malicious field value in a raw message to the ActionMessage.

Recommendations For versions 2.1.x through 2.3.x, consider disabling the Struts 1 plugin until a patch is available to prevent remote code execution via malicious field values in raw messages to the ActionMessage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-02059

CVE-2017-9791

GHSA-29RM-6752-GVWV

Produtos afetados

Apache Struts

Referências · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_code_exec_showcase.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-9791.md · Exploit
• 🔥 https://github.com/dragoneeg/Struts2-048 · Exploit
• 🔥 https://exploit-db.com/exploits/44643 · Exploit
• 🔥 https://exploit-db.com/exploits/42324 · Exploit
• https://github.com/apache/struts/commit/ffe0e20edd9d5386f4410fddd970286a69373243 · Nota
• https://struts.apache.org/docs/s2-048.html · Nota
• https://osv.dev/vulnerability/CVE-2017-9791 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html · Correção
• https://osv.dev/vulnerability/GHSA-29rm-6752-gvwv · Aviso do Fabricante
• https://t.me/cvenotify/110303 · Publicação no Telegram
• https://tools.cisco.com/security/center/viewAlert.x?alertId=54448 · Nota
• https://bdu.fstec.ru/vul/2017-02059 · Nota de Segurança
• https://t.me/cvenotify/108357 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-9791 · Nota de Segurança