This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache Struts 2 fixes a critical vulnerability
Apache Struts since version 6.4.0 contains a fix for a critical vulnerability, which, however, requires not only updating the framework but also a change in the application code [1][2]. If the older File Upload mechanism is used, migration to the newer Action File Upload mechanism is necessary due to backward incompatibility [3]. Without this change, the application remains vulnerable even after the framework is updated [1][2].
An unauthenticated remote attacker can, under certain circumstances, upload a file to arbitrary locations on the machine due to a flaw in the file upload logic, which may lead to code execution [1][4]. PoCs exist for the vulnerability, and according to available information some of them are already being actively exploited by attackers [2][5][6].
The vulnerability is present in product:
- Apache Struts; >=2.0.0, <=2.3.37; >=2.5.0, <=2.5.33; >=6.0.0, <=6.3.0.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-53677 at cve.org, NVD
- CWE-434: Unrestricted Upload of File with Dangerous Type at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
Links
- [1] https://cwiki.apache.org/confluence/display/WW/S2-067
- [2] https://isc.sans.edu/diary/31520
- [3] https://struts.apache.org/core-developers/action-file-upload
- [4] https://nvd.nist.gov/vuln/detail/CVE-2024-53677
- [5] https://github.com/TAM-K592/CVE-2024-53677-S2-067
- [6] https://github.com/EQSTLab/CVE-2024-53677
By CESNET, z.s.p.o. Michaela Ručková on 3. 1. 2025.