PT-2024-9392 · Apache · Apache Struts

Shinsaku Nomura · CVE-2024-53677 · Published 2024-11-26 · Updated 2025-09-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Summary

Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.3.0.2.

Description

A critical flaw exists in the file upload logic of Apache Struts. An attacker can manipulate file upload parameters to enable path traversal, potentially leading to the upload of a malicious file and subsequent Remote Code Execution (RCE). Exploitation is actively occurring in the wild, with proof-of-concept exploits available. Successful exploitation could allow an attacker to install programs, view, change, or delete data, or create new accounts with full user rights, depending on the privileges of the affected service account.

Recommendations

Upgrade to version 6.4.0 or later and migrate to the new file upload mechanism. If utilizing a configuration that does not use the FileUploadInterceptor, the application is not vulnerable.

Exploit

Fix

RCE

LPE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-915

CWE-22

CWE-434

Related Identifiers

BDU:2024-11084

CVE-2024-53677

GHSA-43MQ-6XMG-29VM

Affected Products

Apache Struts

References · 175

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53677.json · Exploit
• 🔥 https://github.com/TAM-K592/CVE-2024-53677-S2-067 · Exploit
• 🔥 https://github.com/XiaomingX/CVE-2024-53677-S2-067 · Exploit
• 🔥 https://github.com/cloudwafs/s2-067-CVE-2024-53677 · Exploit
• 🔥 https://github.com/c4oocO/CVE-2024-53677-Docker · Exploit
• 🔥 https://github.com/EQSTLab/CVE-2024-53677 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53677 · Security Note
• https://cwiki.apache.org/confluence/display/WW/S2-067 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53677 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11084 · Security Note
• https://osv.dev/vulnerability/GHSA-43mq-6xmg-29vm · Vendor Advisory
• https://github.com/apache/struts · Note
• https://github.com/apache/struts/commit/930fef7679d7247db9e460c146b1698a9d7ad1e4 · Note
• https://github.com/apache/struts/commit/1ecfbae46543a83e131404f8dcc84b3d0d554854 · Note
• https://github.com/apache/struts/commit/3ef9ade8902a63bb560892453eeca02bfddefc78 · Note