PT-2017-2796 · Apache · Apache Struts

Icez + 2 · Published 2017-07-10 · Updated 2025-09-22 · CVE-2017-9791

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.x through 2.3.x

Description The issue exists due to insufficient validation of user-input data that is part of a message, allowing a remote attacker to execute arbitrary code. This can be achieved by passing a malicious field value in a raw message to the ActionMessage.

Recommendations For versions 2.1.x through 2.3.x, consider disabling the Struts 1 plugin until a patch is available to prevent remote code execution via malicious field values in raw messages to the ActionMessage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-02059

CVE-2017-9791

GHSA-29RM-6752-GVWV

Affected Products

Apache Struts

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_code_exec_showcase.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-9791.md · Exploit
• 🔥 https://github.com/dragoneeg/Struts2-048 · Exploit
• 🔥 https://exploit-db.com/exploits/44643 · Exploit
• 🔥 https://exploit-db.com/exploits/42324 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9791 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html · Patch
• https://osv.dev/vulnerability/GHSA-29rm-6752-gvwv · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02059 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-9791 · Security Note
• http://struts.apache.org/docs/s2-048.html · Vendor Advisory
• https://github.com/apache/struts/commit/ffe0e20edd9d5386f4410fddd970286a69373243 · Note
• https://struts.apache.org/docs/s2-048.html · Note
• https://t.me/cvenotify/110303 · Telegram Post
• https://tools.cisco.com/security/center/viewAlert.x?alertId=54448 · Note