Potential Apache Struts 2 RCE flaw fixed, PoCs released

CVE-2017-5638 is an improper input validation flaw (CWE-20) in the Jakarta Multipart parser of Apache Struts, in which the parser mishandles the Content-Type value of a file upload and allows malicious upload leading to remote code execution. It is triggered remotely without authentication by sending a crafted Content-Type header in a multipart request to a Struts endpoint; no valid upload or credentials are required. A successful attacker gains code execution in the security context of the application server, which typically enables host compromise, data theft, or ransomware deployment. Any organization running Apache Struts applications that use the Jakarta Multipart parser is affected; the provided data specifies only "Apache Struts" and gives no version ranges. Exploitation is confirmed in the wild: the flaw is listed in CISA KEV (added 2021-11-03) with known ransomware use, EPSS assigns it roughly a 100% exploitation probability (100th percentile), and no public PoC is catalogued in the source data.

Do: Apply updates per vendor instructions: upgrade Apache Struts to the releases that fix this flaw (2.3.32 / 2.5.10.1 or later, per Apache advisory S2-045), and check for Struts jars bundled inside application packages and vendor appliances. Prioritize internet-facing apps, and as an interim mitigation validate or filter the Content-Type header on multipart requests. Because exploitation is in the wild and ransomware use is known, also review web and application server logs for evidence of successful compromise.

Apache Struts 2 contains an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution when an attacker-controlled namespace (for example, part of the request URL path) is evaluated as an OGNL expression on the server. It is triggered under two circumstances: (1) the alwaysSelectFullNamespace option is true and a result defined in the configuration has no namespace while its parent package's namespace is unset or a wildcard, or (2) a URL tag in a template has no namespace under the same parent-package conditions. An attacker who can reach an application in one of these configurations gains arbitrary code execution with the privileges of the application server, so any organization running affected Struts 2 releases (2.3.7-2.3.34 and 2.5-2.5.16) in such configurations is exposed. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild (ransomware use unknown), and EPSS currently assigns a 100% probability of exploitation within 30 days. CVSS is not yet scored in this feed, but the KEV listing and EPSS signal indicate urgent patching priority.

Do: Upgrade Apache Struts to 2.3.35 or 2.5.17 (or later) on all applications, prioritizing internet-facing ones, per vendor instructions. If upgrading is not immediately possible, set alwaysSelectFullNamespace to false and ensure every result and URL tag specifies an explicit, non-wildcard namespace. Audit configurations, especially applications using the Convention Plugin or wildcard namespaces, for the vulnerable conditions and review web server logs for signs of OGNL injection in namespace values.

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.