Apache Struts Deserialization of Untrusted Data Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CISA: Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.htmlPatchThird Party Advisory
• www.securityfocus.com/bid/100609Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/id/1039263Broken LinkThird Party AdvisoryVDB Entry
• blogs.apache.org/foundation/entry/apache-struts-statement-on-equifaxVendor Advisory
• bugzilla.redhat.com/show_bug.cgiIssue TrackingThird Party AdvisoryVDB Entry
• cwiki.apache.org/confluence/display/WW/S2-052MitigationVendor Advisory
• lgtm.com/blog/apache_struts_CVE-2017-9805Broken Link
• security.netapp.com/advisory/ntap-20170907-0001Third Party Advisory
• struts.apache.org/docs/s2-052.htmlMitigationVendor Advisory
• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2Third Party Advisory
• www.exploit-db.com/exploits/42627ExploitThird Party AdvisoryVDB Entry
• www.kb.cert.org/vuls/id/112992Third Party AdvisoryUS Government Resource
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource