PT-2017-2795 · Apache+1 · Apache Struts+1

Man Yue Mo · Published 2017-09-05 · Updated 2026-03-10 · CVE-2017-9805

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.1 through 2.3.x before 2.3.34 Apache Struts versions 2.5.x before 2.5.13

Description The issue is related to the REST Plugin in Apache Struts, which uses an XStreamHandler with an instance of XStream for deserialization without any type filtering. This can lead to Remote Code Execution when deserializing XML payloads. The vulnerability exists due to the lack of filtering during the deserialization of XML requests, allowing remote attackers to execute arbitrary code.

Recommendations For Apache Struts versions 2.1.1 through 2.3.x before 2.3.34, upgrade to version 2.3.34 or later. For Apache Struts versions 2.5.x before 2.5.13, upgrade to version 2.5.13 or later. As a temporary workaround, consider disabling the XStreamHandler until a patch is available. Restrict access to the REST Plugin to minimize the risk of exploitation. Avoid using the XStream library for deserialization until the issue is resolved.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

APACHESTRUTSCVE20179805CHECK

BDU:2017-02057

BDU:2017-02058

CVE-2017-9805

GHSA-29RM-6752-GVWV

GHSA-8FX9-5HX8-CRHM

GHSA-8MR5-H28G-36QX

GHSA-9GP7-JVM2-R4MX

GHSA-GG9M-FJ3V-R58C

GHSA-VWXJ-6M5M-RRVH

GHSA-X5X7-3V85-WPC4

Affected Products

Apache Struts

Xstream

References · 97

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_rest_xstream.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-9805.md · Exploit
• 🔥 https://github.com/mazen160/struts-pwn_CVE-2017-9805 · Exploit
• 🔥 https://github.com/luc10/struts-rce-cve-2017-9805 · Exploit
• 🔥 https://github.com/0x00-0x00/-CVE-2017-9805 · Exploit
• 🔥 https://github.com/chrisjd20/cve-2017-9805.py · Exploit
• 🔥 https://github.com/Lone-Ranger/apache-struts-pwn_CVE-2017-9805 · Exploit
• 🔥 https://github.com/hahwul/struts2-rce-cve-2017-9805-ruby · Exploit
• 🔥 https://github.com/Shakun8/CVE-2017-9805 · Exploit
• 🔥 https://exploit-db.com/exploits/42627 · Exploit
• https://osv.dev/vulnerability/GHSA-8fx9-5hx8-crhm · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02057 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gg9m-fj3v-r58c · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 · Vendor Advisory