PT-2023-7502 · Apache · Apache Struts

Steven Seeley · CVE-2023-50164 · Published 2023-12-03 · Updated 2025-11-11

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.5.32 Apache Struts versions 6.0.0 through 6.3.0.1

Description A critical vulnerability has been identified in Apache Struts, allowing attackers to manipulate file upload parameters and enable path traversal, potentially leading to remote code execution. This issue is related to the file upload component of Apache Struts, which contains a directory traversal vulnerability. The vulnerability can be exploited by manipulating the uploadFileName parameter, allowing attackers to upload malicious files to arbitrary locations on the server.

Recommendations To resolve the issue, upgrade to Apache Struts version 2.5.33 or later, or version 6.3.0.2 or later. As a temporary workaround, consider restricting access to the file upload functionality to minimize the risk of exploitation. Additionally, restrict access to the vulnerable uploadFileName parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Files Accessible to External Parties

Path traversal

Weakness Enumeration

CWE-552

CWE-22

Related Identifiers

BDU:2023-08547

CVE-2023-50164

GHSA-2J39-QCJM-428W

Affected Products

Apache Struts

References · 307

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50164.json · Exploit
• 🔥 https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE · Exploit
• 🔥 https://github.com/dwisiswant0/cve-2023-50164-poc · Exploit
• 🔥 https://github.com/Trackflaw/CVE-2023-50164-ApacheStruts2-Docker · Exploit
• 🔥 https://github.com/bcdannyboy/CVE-2023-50164 · Exploit
• 🔥 https://github.com/snyk-labs/CVE-2023-50164-POC · Exploit
• https://osv.dev/vulnerability/GHSA-2j39-qcjm-428w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50164 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50164 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08547 · Security Note
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/162e29fee9136f4bfd9b2376da2cbf590f9ea163 · Note
• https://github.com/apache/struts/commit/d8c69691ef1d15e76a5f4fcf33039316da2340b6 · Note
• https://t.me/cvenotify/64462 · Telegram Post
• https://twitter.com/Jgarverick/status/1740905545286980027 · Twitter Post