Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
by CIRT Team
Description: The REST Plugin is using a XStreamHandler with an instance of XStream for deserialization without any type filtering and this can lead to Remote Code Execution when deserializing XML payloads.
Impact: Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Apache Struts 2.5 through 2.5.12 are vulnerable.
Mitigation: Updates are available. Please check specific vendor advisory for more information.
Reference URL’s:
- http://www.securityfocus.com/bid/100609/info
- https://struts.apache.org/docs/s2-052.html
- https://struts.apache.org/docs/version-notes-2513.html
- https://lgtm.com/blog/apache_struts_CVE-2017-9805_announcement
Recommended Posts
Cyber Threat Alert: Surge in Attacks via Compromised Third-Party Service Providers
08 Feb 2024 - Articles, English articles, Security Advisories & Alerts
Subscribe here
MEMBER OF:
