CISA KEV 정보
| 취약점명 | Apache Struts Remote Code Execution Vulnerability |
|---|---|
| 설명 | Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution. |
| 조치사항 | Apply updates per vendor instructions. |
| 랜섬웨어 캠페인 악용 | Known |
| CWE | CWE-20 |
| 등록일 (KEV) | 2021-11-03 |
| 조치 기한 | 2022-05-03 |
| 추가 참고 | https://nvd.nist.gov/vuln/detail/CVE-2017-5638 |
NVD 상세 정보
CVSS v3.1: 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS v2.0: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C설명: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CWE: CWE-755 | CWE-755
참조
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html [Exploit, Third Party Advisory]
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ [Exploit, Third Party Advisory]
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt [Third Party Advisory]
- http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html [Press/Media Coverage, Third Party Advisory]
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html [Patch, Third Party Advisory]
- http://www.securityfocus.com/bid/96729 [Broken Link, Third Party Advisory, VDB Entry]
- http://www.securitytracker.com/id/1037973 [Broken Link, Third Party Advisory, VDB Entry]
- https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/ [Exploit, Press/Media Coverage]
- https://cwiki.apache.org/confluence/display/WW/S2-045 [Mitigation, Vendor Advisory]
- https://cwiki.apache.org/confluence/display/WW/S2-046 [Mitigation, Vendor Advisory]
- https://exploit-db.com/exploits/41570 [Exploit, Third Party Advisory, VDB Entry]
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=352306493971e7d5a756d61780d57a76eb1f519a [Broken Link]
- https://git1-us-west.apache.org/repos/asf?p=struts.git%3Ba=commit%3Bh=6b8272ce47160036ed120a48345d9aa884477228 [Broken Link]
- https://github.com/mazen160/struts-pwn [Exploit]
- https://github.com/rapid7/metasploit-framework/issues/8064 [Exploit, Issue Tracking]
- ... 외 52건
This product uses the NVD API but is not endorsed or certified by the NVD.