CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
Other sources
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
— GitHub
The REST Plugin is using a XStreamHandler with an instance of XStream for deserialization without any type filtering and this can lead to Remote Code Execution when deserializing XML payloads.
Affected versions:
Struts 2.5 - Struts 2.5.12
External References:
https://struts.apache.org/docs/s2-052.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/strutsto a version that resolves this vulnerability.Fixed in 2.5.13 - Upgrade
Upgrade
maven/org.apache.struts:struts2-rest-pluginto a version that resolves this vulnerability.Fixed in 2.3.34 - Upgrade
Upgrade
maven/org.apache.struts:struts2-rest-pluginto a version that resolves this vulnerability.Fixed in 2.5.13
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9805?
CVE-2017-9805 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2017-9805?
To fix CVE-2017-9805, upgrade the Apache Struts REST Plugin to version 2.3.34 or later for versions 2.1.2 to 2.3.x, or 2.5.13 for versions 2.5.x.
What are the affected versions for CVE-2017-9805?
CVE-2017-9805 affects Apache Struts versions 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13.
What kind of attacks can exploit CVE-2017-9805?
CVE-2017-9805 can be exploited through specially crafted XML payloads leading to remote code execution.
Are there any specific environments where CVE-2017-9805 is more vulnerable?
CVE-2017-9805 is particularly a concern in environments that make extensive use of the Apache Struts REST Plugin without proper type filtering during XML deserialization.