{"id":"CVE-2017-9805","kind":"vulnerability","aliases":["CVE-2017-9805"],"related":[],"title":"Apache Struts: Apache Struts Deserialization of Untrusted Data Vulnerability","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","summary":"Apache Struts' REST Plugin deserializes XML with XStream without type filtering, so a crafted XML request can trigger deserialization of attacker-chosen objects. An unauthenticated remote attacker can run code on the server.","severity":"critical","cvss":8.1,"epss":0.99396,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apache Struts","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-struts","exploited","java","package","rest-plugin","struts"],"not_affected_if":["no-rest-plugin","non-java"],"how_to_check":"Check whether the struts2-rest-plugin jar is in the app's WEB-INF/lib or dependency tree and whether the app uses REST/XML handling.","fix":"Upgrade Apache Struts to a fixed release per the vendor advisory, or remove the REST plugin if unused.","status":"open","published_at":"2017-09-15T19:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:15+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:37:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Struts to a fixed release per the vendor advisory, or remove the REST plugin if unused.\nunknown","reach":"internet","impact":"high","summary":"Apache Struts' REST Plugin deserializes XML with XStream without type filtering, so a crafted XML request can trigger deserialization of attacker-chosen objects. An unauthenticated remote attacker can run code on the server.","category":"package","who_cares":["struts","java","apache-struts","rest-plugin"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote code execution on the server through crafted XML payloads.","analyst_note":"Sources do not list affected or fixed versions; confirm exact version ranges and fixed release from the Apache Struts security bulletin for S2-052.","how_to_check":"Check whether the struts2-rest-plugin jar is in the app's WEB-INF/lib or dependency tree and whether the app uses REST/XML handling.\nunknown","needs_analyst":true,"not_affected_if":["no-rest-plugin","non-java"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000489,"input_tokens":2840,"output_tokens":409,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2017':11A,14A '-9805':12A,15A '2.1.1':68C '2.3':70C '2.3.34':73C '2.5':75C '2.5.13':78C 'apach':1A,3A,19B,28B,66C 'apache':16A 'apache-strut':18B 'attack':49B,55B 'attacker-chosen':48B 'chosen':50B 'code':58B,98C 'craft':41B 'cve':10A,13A 'data':8A 'deseri':5A,32B,46B,88C,101C 'execut':99C 'exploit':21B 'filter':38B,92C 'instanc':84C 'java':22B 'lead':95C 'object':51B 'packag':23B 'payload':103C 'plugin':26B,31B,64C 'remot':54B,97C 'request':43B 'rest':25B,30B,63C 'rest-plugin':24B 'run':57B 'server':61B 'strut':2A,4A,20B,27B,29B,67C 'struts':17A 'trigger':45B 'type':37B,91C 'unauthent':53B 'untrust':7A 'use':79C 'vulner':9A 'without':36B,89C 'x':71C,76C 'xml':33B,42B,102C 'xstream':35B,86C 'xstreamhandl':81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-09-15T19:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-9805","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9805","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2017-9805","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-9805","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-9805","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","severity":null,"published_at":"2017-09-15T19:29:00+00:00","modified_at":"2026-06-17T01:28:57+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}