CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability

CVE-2017-5638 is a remote code execution vulnerability in Apache Struts stemming from improper handling of input in the Jakarta Multipart parser. An attacker can abuse the Content-Type value during file upload handling to achieve code execution on the server. This matters because Struts is widely used in Java web applications; successful exploitation can give an attacker full control of the affected host, and the vulnerability has been used in ransomware campaigns. Confirm all version and configuration details against the vendor advisory before acting.

How it works

The underlying weakness is CWE-20 (Improper Input Validation). According to the CISA summary, the Apache Struts Jakarta Multipart parser allows malicious file upload activity that abuses the Content-Type value, which can lead directly to remote code execution. In practical terms, the parser does not adequately validate or constrain attacker-controlled header data associated with multipart requests. A remote, unauthenticated attacker who can reach an endpoint that processes multipart form data may supply a crafted Content-Type value that the parser mishandles, resulting in execution of attacker-chosen code in the context of the Struts application.

Exact request structure, payload format, and affected code paths are not detailed here; defenders must treat any publicly reachable Struts multipart upload endpoint as potentially exploitable until the vendor advisory and their own inventory confirm otherwise. Because the result is remote code execution, post-exploitation can include web shells, lateral movement, data theft, or deployment of ransomware.

Am I affected? How to find it in your systems

Apache Struts is a Java framework commonly embedded in enterprise web applications, often running on application servers such as Tomcat, JBoss/WildFly, WebLogic, or similar. It may appear as a direct dependency or be bundled inside custom or third-party WAR/EAR packages.

• Inventory all Java web applications and application servers. Search code repositories, build manifests (pom.xml, build.gradle), and deployed lib directories for Struts libraries (for example, struts2-core or related JARs).
• Identify any endpoints that accept multipart/form-data uploads or file submissions; these are the primary attack surface for this parser issue.
• Compare discovered Struts versions and configurations against the vendor advisory for CVE-2017-5638. Do not assume a version is safe without confirmation.
• Review web server, application, and WAF logs for anomalous multipart requests, unusual Content-Type header values, unexpected file upload activity, or subsequent suspicious process execution, outbound connections, or new files under the application account.
• Where available, use software composition analysis or runtime inventory tools to flag Struts components and map them to internet-facing or high-value applications.

If you cannot determine the exact Struts version or whether the Jakarta Multipart parser is in use, treat the application as potentially affected until proven otherwise.

How to remediate

Patching is the primary remediation. Apply the updates provided by the vendor for Apache Struts exactly as described in the official advisory for CVE-2017-5638. CISA’s required action is to apply updates per vendor instructions. After patching, redeploy or restart affected applications as required and verify the new library versions are loaded at runtime.

• Prioritize internet-facing and high-sensitivity applications first.
• Rebuild and redeploy from a clean pipeline so that old Struts JARs are not left in exploded deployments or shared lib directories.
• Harden input handling more broadly: restrict or validate Content-Type and other headers at the application or reverse-proxy layer, limit multipart parser resource usage, and avoid exposing unnecessary upload functionality.
• Ensure the application runs with least privilege so that any future parser issues have reduced impact.
• Re-scan or re-inventory after remediation to confirm the vulnerable components are gone.

If you can't patch immediately

If an immediate upgrade is not possible, reduce exposure with compensating controls while you schedule the vendor update.

• Segment and restrict access: place affected applications behind strict network controls so that only trusted clients can reach multipart upload endpoints; block direct internet access where feasible.
• Virtual patching / WAF: deploy or tune web application firewall rules that inspect and block suspicious Content-Type values and malformed multipart requests associated with this class of attack. Confirm rule coverage with your WAF vendor; rules are not a substitute for the official patch.
• Disable or constrain the affected feature: if the application does not require file upload or multipart parsing, disable those endpoints or the Jakarta Multipart parser configuration until patched.
• Monitoring and response: increase logging and alerting on multipart requests, anomalous Content-Type headers, unexpected child processes spawned by the application server, and unusual outbound traffic. Prepare to isolate hosts showing signs of exploitation.
• Credential and session hygiene: rotate application and service account credentials that the Struts process can access, in case compromise has already occurred.

These measures lower risk but do not eliminate it; plan to apply the vendor update as soon as possible.

If your data may have been exposed

This vulnerability enables remote code execution and has known ransomware use. If exploitation is suspected or confirmed, treat the incident as a potential breach: isolate affected systems, preserve logs and forensic images, and follow your incident response process, including notification obligations. Determine what data the compromised application could access and whether ransomware or data exfiltration occurred. As a further check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated credentials or personal information have appeared in prior breaches, then force password resets and enable multi-factor authentication where relevant.