CVE-2017-9805 REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
HighCVSS 8.1
EPSS 99.4%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-rest-plugin(Maven) | >= 2.1.1, < 2.3.34 | 2.3.34 |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.1.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.1.6 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.1.8 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.1.8.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.2.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.2.1.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.2.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.2.3.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.1.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.1.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.12 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.14 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.14.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.14.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.14.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.15 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.15.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.15.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.15.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.16 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.16.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.16.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.16.3 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.20.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.24.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.28 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.28.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.29 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.3 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.30 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.31 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.32 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.33 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.4 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.4.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.7 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.3.8 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | >= 2.5.0, < 2.5.13 | 2.5.13 |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.10 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.10.1 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.12 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.2 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.5 | No fix listed |
| org.apache.struts/struts2-rest-plugin(Maven) | = 2.5.8 | No fix listed |
| apache struts | >= 2.1.2, < 2.3.34 | 2.3.34 |
| apache struts | >= 2.5.0, < 2.5.13 | 2.5.13 |
| cisco digital media manager | All versions | No fix listed |
| cisco hosted collaboration solution | = 10.5(1) | No fix listed |
| cisco hosted collaboration solution | = 11.0(1) | No fix listed |
| cisco hosted collaboration solution | = 11.5(1) | No fix listed |
| cisco hosted collaboration solution | = 11.6(1) | No fix listed |
| cisco media experience engine | = 3.5 | No fix listed |
| cisco media experience engine | = 3.5.2 | No fix listed |
| cisco network performance analysis | All versions | No fix listed |
| cisco video distribution suite for internet streaming | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| Apache Struts | = Apache Struts before 2.3.34 and 2.5.x before 2.5.13 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- blogs.apache.org vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- cwiki.apache.org mitigation vendor-advisory
- github.com product
- lgtm.com broken-link
- security.netapp.com third-party-advisory
- struts.apache.org mitigation vendor-advisory
- 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017 third-party-advisory vendor-advisory
- web.archive.org
- web.archive.org
- www.cisa.gov government-resource us-government-resource
- 42627 exploit third-party-advisory vdb-entry
- VU#112992 third-party-advisory us-government-resource
- www.oracle.com patch third-party-advisory
- 100609 broken-link third-party-advisory vdb-entry
- 1039263 broken-link third-party-advisory vdb-entry
- github.com