{"id":"CVE-2017-5638","kind":"vulnerability","aliases":["CVE-2017-5638"],"related":[],"title":"Apache Struts: Apache Struts Remote Code Execution Vulnerability","description":"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.","summary":"Apache Struts's Jakarta Multipart parser mishandles a malicious Content-Type header on file uploads, letting an attacker run code on the server. CISA lists it as actively exploited, and ransomware use is tagged.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apache Struts","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-struts","exploited","java","package","ransomware","self-hosted","struts"],"not_affected_if":["jakarta-multipart-disabled","no-struts-usage"],"how_to_check":null,"fix":"Upgrade Apache Struts to a fixed release per vendor instructions (version not stated in sources).\nSources do not name the fixed version.","status":"open","published_at":"2017-03-11T02:59:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:07+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:37:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Struts to a fixed release per vendor instructions (version not stated in sources).\nSources do not name the fixed version.","reach":"internet","impact":"high","summary":"Apache Struts's Jakarta Multipart parser mishandles a malicious Content-Type header on file uploads, letting an attacker run code on the server. CISA lists it as actively exploited, and ransomware use is tagged.","category":"package","who_cares":["java","struts","apache-struts","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the server via upload request.","analyst_note":"Find affected and fixed Struts version ranges and the Jakarta Multipart detection method in the NVD or Apache Struts security bulletin S2-045 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-struts-usage","jakarta-multipart-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000471,"input_tokens":2821,"output_tokens":378,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find affected and fixed Struts version ranges and the Jakarta Multipart detection method in the NVD or Apache Struts security bulletin S2-045 and the CISA KEV entry.","search":"'-2017':10A,13A '-5638':11A,14A '2':70C '2.3':71C '2.3.32':74C '2.5':76C '2.5.10.1':79C '2017':124C 'activ':56B 'allow':95C 'apach':1A,3A,18B,28B,68C 'apache':15A 'apache-strut':17B 'arbitrari':100C 'attack':46B,97C 'attempt':93C 'cisa':52B 'cmd':133C 'code':6A,48B 'command':101C 'contain':131C 'content':38B,106C,109C,113C,128C 'content-disposit':108C 'content-length':112C 'content-typ':37B,105C,127C 'craft':104C 'cve':9A,12A 'disposit':110C 'error':86C 'error-messag':85C 'except':82C 'execut':7A,99C 'exploit':20B,57B,118C 'file':42B,91C 'file-upload':90C 'generat':88C 'handl':83C 'header':40B,116C,130C 'host':26B 'http':115C 'incorrect':81C 'jakarta':31B,64C 'java':21B 'length':114C 'let':44B 'list':53B 'malici':36B 'march':123C 'messag':87C 'mishandl':34B 'multipart':32B,65C 'packag':22B 'parser':33B,66C 'ransomwar':23B,59B 'remot':5A,96C 'run':47B 'self':25B 'self-host':24B 'server':51B 'string':134C 'strut':2A,4A,19B,27B,29B,69C 'struts':16A 'tag':62B 'type':39B,107C,129C 'upload':43B,92C 'use':60B 'via':102C 'vulner':8A 'wild':121C 'x':72C,77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-11T02:59:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-5638","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-5638","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T19:35:26+00:00","note":null},{"source":"epss","external_id":"CVE-2017-5638","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-5638","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-5638","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","severity":null,"published_at":"2017-03-11T02:59:00+00:00","modified_at":"2026-06-17T01:20:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}