CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability

CVE-2017-9805 is a deserialization vulnerability in Apache Struts that can allow remote code execution. It affects the REST Plugin, which processes XML payloads using XStream without adequate type filtering. For IT and security teams, this matters because successful abuse can give an attacker the ability to run code in the context of the application server, potentially leading to full compromise of the host or downstream systems that trust it.

Public detail is limited to the weakness class and the high-level mechanism described by CISA; exact affected versions, configuration prerequisites, and patch identifiers must be confirmed against the vendor advisory before you act.

How it works

The flaw belongs to CWE-502: deserialization of untrusted data. In this case the Apache Struts REST Plugin uses an XStreamHandler backed by an XStream instance that performs deserialization without type filtering. When an application accepts XML input that is passed to this handler, an attacker who can supply a crafted XML payload may cause the deserializer to instantiate unexpected classes and invoke methods that result in remote code execution.

At a technical level the attack surface is any endpoint that accepts XML and routes it through the vulnerable REST Plugin deserialization path. No further exploit mechanics are provided in the available facts; defenders should treat any untrusted XML reaching that code path as potentially dangerous and verify the precise conditions in the vendor advisory.

Am I affected? How to find it in your systems

Apache Struts is a Java web-application framework commonly found in enterprise Java EE or servlet-container deployments (for example Tomcat, JBoss/WildFly, WebLogic, or embedded containers). The REST Plugin is an optional or separately enabled component; not every Struts installation will have it active.

• Inventory Java web applications and identify those that bundle or depend on Apache Struts. Check build manifests (pom.xml, build.gradle), lib directories, and packaged WARs/EARs for Struts libraries and the REST Plugin.
• Confirm whether the REST Plugin is enabled and whether it is configured to handle XML content types. Review application configuration and web.xml or equivalent plugin declarations.
• Compare the Struts and plugin versions in use against the fixed versions listed in the vendor advisory; do not rely on version guesses.
• For runtime detection, look for HTTP requests that submit XML to REST-style endpoints, especially those that produce unusual errors, stack traces mentioning XStream or deserialization, or unexpected process creation. Application and container logs, WAF logs, and EDR process telemetry are the primary sources; there is no universal signature supplied in the public facts.

How to remediate

Patch first. Apply the updates published by the Apache Struts project exactly as directed in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; that remains the definitive remediation.

• After patching, re-test the previously vulnerable endpoints to confirm that untrusted XML is no longer deserialized without type controls.
• For this class of weakness, harden deserialization generally: restrict or eliminate the use of XStream (or similar) on untrusted input, enable allow-lists / type filtering where the library supports it, and prefer data formats that do not embed executable object graphs.
• Reduce the privilege level of the application server process so that any future deserialization bug has a smaller blast radius.
• Remove or disable the REST Plugin entirely if the application does not require it.

If you can't patch immediately

Compensating controls can lower risk until the vendor update is deployed, but they are not a substitute for patching.

• Network segmentation: isolate Struts hosts from untrusted networks and limit which clients can reach the REST endpoints.
• Virtual patching / WAF: block or strictly validate XML payloads destined for Struts REST endpoints; reject content that does not match expected schemas. Tune rules carefully to avoid breaking legitimate traffic.
• Disable the affected feature: turn off the REST Plugin or XML handling if business functionality permits.
• Monitoring: alert on anomalous XML POST/PUT traffic, deserialization-related exceptions, and unexpected child processes spawned by the application server. Retain logs for later forensic review.
• Least privilege and containment: ensure the service account has minimal file-system and network rights, and consider running the application in a tightly confined container or jail.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities are frequently used as an initial access vector that can lead to data theft or further compromise. Known ransomware use of this specific CVE is not documented in the supplied facts, but that does not rule out other post-exploitation activity. If you have reason to believe an affected system was reachable and unpatched, treat it as a potential incident: isolate the host, preserve volatile evidence, and begin your incident-response process. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information associated with your organization have already appeared in public breach corpora.