Apache Struts Remote Code Execution Vulnerability (CVE-2017-5638)

What is affected, what to do

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update struts to version 2.5.10.1, clearpass_policy_manager to version 6.6.5. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Apache Struts eq 2.3.x before 2.3.32..2.3.x before 2.3.32
• Apache Struts eq 2.5.x before 2.5.10.1..2.5.x before 2.5.10.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Sweep all Java web applications for Struts 2 libraries (find / -name "struts2-core-*.jar" 2>/dev/null, including inside WAR/EAR archives and fat JARs). Affected: 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1. Legacy lines such as 2.2.3 are end-of-life and need migration.
   • Patch: Upgrade to Apache Struts 2.3.32 or 2.5.10.1 (Apache security bulletins S2-045/S2-046). Where feasible, jump straight to a currently supported Struts release — the old lines carry further OGNL injection flaws.
   • Third-party products: Check HP/Micro Focus Server Automation (9.1.0, 10.0.0, 10.1.0) and Aruba ClearPass Policy Manager. Bring ClearPass to at least 6.6.5. For Server Automation a vendor patch is available — look up the fixed version in the vendor advisory.
   • Cut exposure: Put internet-facing Struts apps that cannot be patched today (typically TCP 80/443/8080/8443) behind a header-filtering reverse proxy, or take them offline until fixed.
   • Assume breach: Given years of mass exploitation, treat any still-unpatched host as potentially compromised: hunt for webshells in the webroot (recently modified *.jsp), review cron jobs/scheduled tasks and new local accounts, rotate the application's service and database credentials.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/reverse proxy: Drop requests whose Content-Type, Content-Disposition or Content-Length header contains %{, ${, #cmd=, ognl, _memberAccess, @java.lang or ProcessBuilder. ModSecurity example: SecRule REQUEST_HEADERS:Content-Type "@rx [%$]\{" "id:1005638,phase:1,deny,log". Enable OWASP CRS and your IPS vendor's CVE-2017-5638 signatures.
   • Application config (workaround): Switch the multipart parser from Jakarta to pell (2.3.x) or jakarta-stream (2.5.x) via struts.multipart.parser, or add a servlet filter that rejects upload requests whose Content-Type is not multipart/form-data. If uploads aren't needed, remove the file-upload interceptor.
   • Network segmentation: Restrict application-server egress to an allow-list (database, required APIs) and block direct internet egress to stop payload staging (wget/curl/PowerShell) and reverse shells.
   • Host hardening: Run Tomcat/JBoss/WebLogic under a dedicated unprivileged account, remove write access to the webroot, enforce SELinux/AppArmor profiles or the Java Security Manager, and use EDR policy to block shell interpreters for the service user.
   • IAM: Scope the application's database and secrets access to least privilege to limit blast radius (data exfiltration, lateral movement).
3. 03

   Runbook step 3

   Detection rules

   • Proxy/WAF logs: OGNL expressions in Content-Type. SPL: index=proxy http_content_type="*%{*" OR http_content_type="*#cmd=*" OR http_content_type="*_memberAccess*". Note that default Apache/Tomcat access logs usually omit Content-Type — extend the log format or rely on WAF/Zeek data.
   • Network telemetry: Zeek http.log or Suricata with ET rules for CVE-2017-5638 / "Apache Struts Jakarta Multipart" enabled; also flag POST responses carrying plaintext command output (uid=, root:x:0:0).
   • EDR/Sysmon (EID 1) process ancestry: java/tomcat*.exe spawning cmd.exe, powershell.exe, sh, bash, curl, wget, certutil. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","tomcat9.exe") and FileName in~ ("cmd.exe","powershell.exe","certutil.exe").
   • Linux auditd: execve events whose parent is the JVM and whose uid is the web service account, e.g. -a always,exit -F arch=b64 -S execve -F uid=tomcat -k struts_exec.
   • Persistence/file system: Sysmon EID 11 or FIM on new .jsp/.jspx files in the webroot, plus cryptominer artefacts (unknown binaries in /tmp, /var/tmp, /dev/shm with sustained high CPU).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), OSV (Open Source Vulnerabilities), cvelistv5

Vendors and products

• Apache Software Foundation Apache Struts
• Apache Software Foundation Apache Struts
• Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager
• Hewlett Packard Enterprise
• IBM Storwize V3500 Firmware
• IBM IBM Storwize V5000 Firmware
• IBM IBM Storwize V7000 Firmware
• Lenovo
• NetApp Netapp Oncommand Balance
• Oracle Oracle WebLogic Server

References & sources

• NVD (NIST)vuln/detail/CVE-2017-5638advisory
• github.comrapid7/metasploit-framework/issues/8064web, x_refsource_MISC, Exploit, Issue tracking
• github.comapache/struts/commit/b06dd50af2a3319dd896bf5c2f4972d2b772cf2bweb
• github.comapache/struts/commit/352306493971e7d5a756d61780d57a76eb1f519aweb
• lists.apache.orgthread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc…web
• lists.apache.org[announce] 20210125 Apache Software Foundation Security Report: 2020web, Mailing list, x_refsource_MLIST, Mailing list
• lists.apache.orgthread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3…web
• nmap.orgnsedoc/scripts/http-vuln-cve2017-5638.htmlweb, x_refsource_MISC, Exploit, Third-party advisory
• packetstormsecurity.comfiles/141494/S2-45-poc.py.txtweb, x_refsource_MISC, Broken link, Exploit, Third-party advisory, Vulnerability database
• security.netapp.comadvisory/ntap-20170310-0001web
• struts.apache.orgdocs/s2-045.htmlweb, x_refsource_CONFIRM, Mitigation, Vendor advisory
• struts.apache.orgdocs/s2-046.htmlweb, x_refsource_CONFIRM, Mitigation, Vendor advisory
• support.lenovo.comus/en/product_security/len-14200web, x_refsource_CONFIRM, Third-party advisory
• twitter.comtheog150/status/841146956135124993web, x_refsource_MISC, Broken link, Third-party advisory
• web.archive.orgweb/20170311203630/http://www.securityfocus.com/bid/96729web
• web.archive.orgweb/20170921030226/http://www.securitytracker.com/id/1037973web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5638web, government-resource, US government resource
• exploit-db.comexploits/41614web
• imperva.comblog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulner…web
• kb.cert.orgVU#834067web, Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource