CVE-2024-53677: Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
Other sources
File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload. If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067 .
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 6.4.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.4.0 - Configuration
Migrate from the old FileuploadInterceptor-based file upload logic to the new file upload mechanism.
Apache Struts file upload mechanism = new file upload mechanism
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53677?
CVE-2024-53677 has been classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-53677?
To mitigate CVE-2024-53677, users should upgrade to Apache Struts version 6.4.0 or later.
What types of attacks can exploit CVE-2024-53677?
CVE-2024-53677 can be exploited through path traversal techniques to upload malicious files leading to remote code execution.
Which software versions are affected by CVE-2024-53677?
CVE-2024-53677 affects all versions of Apache Struts prior to 6.4.0.
Is CVE-2024-53677 under active exploitation?
Yes, CVE-2024-53677 is known to be actively exploited in the wild.