CVE-2017-9791
Apache Struts 1 Improper Input Validation Vulnerability
Description
CVE-2017-9791 is a CRITICAL remote code execution vulnerability in the Struts 1 plugin for Apache Struts, carrying a CVSS 3.1 score of 9.8. The flaw, classified under CWE-20 (Improper Input Validation), resides in the way the plugin handles ActionMessage resources. An attacker can supply a malicious field value that is passed as a raw message to the ActionMessage class, resulting in arbitrary code execution on the server. Because the attack vector is network-based and requires no authentication or user interaction, any internet-facing application using the Struts 1 plugin within affected Apache Struts versions (2.3.x series) is at risk. This CVE was added to CISA's Known Exploited Vulnerabilities catalog on February 10, 2022, with a remediation deadline of August 10, 2022. The EPSS score of 94.24% (99.93rd percentile) reflects near-certain exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | struts | 2.3.1; 2.3.1.1; 2.3.1.2; 2.3.3; 2.3.4; 2.3.4.1; 2.3.7; 2.3.8; 2.3.12; 2.3.14; 2.3.14.1; 2.3.14.2; 2.3.14.3; 2.3.15; 2.3.15.1; 2.3.15.2; 2.3.15.3; 2.3.16; 2.3.16.1; 2.3.16.2; 2.3.16.3; 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; 2.3.28; 2.3.28.1; 2.3.29; 2.3.30; 2.3.31; 2.3.32 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://struts.apache.org/docs/s2-048.html(Mitigation, Vendor Advisory)
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/99484(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038838(Broken Link, Third Party Advisory, VDB Entry)
- https://security.netapp.com/advisory/ntap-20180706-0002/(Third Party Advisory)
- https://www.exploit-db.com/exploits/42324/(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44643/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9791(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2017-9791 is classified under CWE-20 — Improper Input Validation. This weakness arises when an application receives input but does not properly validate whether that input conforms to expected formats, types, or constraints before processing it. In the context of Apache Struts, the Struts 1 plugin accepts user-supplied field values and passes them directly to ActionMessage objects without adequate sanitization.
Improper input validation is one of the most fundamental software weaknesses and serves as the root cause for numerous higher-level vulnerability classes including injection attacks, buffer overflows, and command execution. In this specific case, the failure to validate message parameters in the Struts 1 plugin allows an attacker to inject OGNL (Object-Graph Navigation Language) expressions that the framework evaluates, leading to arbitrary code execution on the application server.
Impact Analysis
CVE-2017-9791 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the severity of unrestricted remote code execution.
Confidentiality (High): Successful exploitation grants an attacker the ability to execute arbitrary commands on the underlying server, providing access to application data, database credentials, configuration files, user records, and any other sensitive information stored on or accessible from the server. In enterprise environments running Struts-based applications, this could include financial records, personal data, and proprietary business information.
Integrity (High): With code execution capabilities, an attacker can modify application logic, alter database records, inject backdoors into the application, deface web content, or tamper with business-critical transactions. The attacker effectively gains the same level of control as the application's service account.
Availability (High): Arbitrary code execution enables an attacker to crash the application server, consume system resources, deploy cryptocurrency miners, or render the service unavailable through various means. Ransomware operators could encrypt server data, causing prolonged outages.
Scope Unchanged: The vulnerability's impact remains within the security scope of the affected Struts application server, though lateral movement from a compromised server is a common post-exploitation activity.
With an EPSS score of 94.24% (99.93rd percentile), this vulnerability has an extremely high likelihood of being exploited in the wild.
Exploit Maturity
CVE-2017-9791 has a high exploit maturity with publicly available exploit code and confirmed active exploitation.
Public exploits available: Multiple exploit modules are publicly available on Exploit-DB (IDs 42324 and 44643), significantly lowering the barrier for exploitation. These exploits demonstrate how to craft malicious field values that trigger OGNL expression evaluation through the Struts 1 plugin's ActionMessage handling.
KEV listing: CISA added CVE-2017-9791 to the Known Exploited Vulnerabilities catalog on February 10, 2022, confirming active exploitation in the wild. The federal remediation deadline was August 10, 2022.
Ransomware association: CISA's KEV catalog does not indicate a known ransomware association for this specific CVE. However, Apache Struts vulnerabilities have historically been favored by both cybercriminal groups and advanced persistent threat actors.
Attack context: The vulnerability is associated with the Apache Struts S2-048 security bulletin. It affects applications that use the Struts 1 plugin with the Struts 2 framework, a common configuration in legacy enterprise Java applications. The attack requires only network access to the application with no authentication needed.
EPSS context: The EPSS score of 94.24% (99.93rd percentile) places this among the most actively exploited vulnerabilities tracked.
Remediation
-
Upgrade Apache Struts immediately. Apply the patches described in the official Apache Struts S2-048 security advisory. Upgrade to a Struts version that addresses this vulnerability — versions beyond the 2.3.x series that include the fix.
-
Remove or disable the Struts 1 plugin if not required. The vulnerability specifically affects the Struts 1 plugin used within Struts 2 applications. If your application does not rely on Struts 1 compatibility features, remove the plugin entirely to eliminate the attack surface.
-
Sanitize ActionMessage resource values. As a defense-in-depth measure, ensure that all user-controlled values passed to ActionMessage objects are properly validated and sanitized. Avoid passing raw, unescaped user input as message parameters.
-
Deploy a web application firewall (WAF). Configure WAF rules to detect and block OGNL injection patterns in HTTP requests targeting Struts applications. This provides a temporary mitigation layer while patches are being applied.
-
Audit for compromise indicators. Review server logs for unusual request patterns targeting Struts endpoints, unexpected process execution, and unauthorized file modifications. Given the age and public availability of exploits, any unpatched system should be assumed compromised.
-
Implement network segmentation. Restrict outbound network access from application servers to limit the impact of successful exploitation, preventing data exfiltration and command-and-control communication.
Technical Details
CVE-2017-9791 is a remote code execution vulnerability in the Struts 1 plugin for Apache Struts 2. The vulnerability exists because the plugin does not properly sanitize user-supplied input before it is used in ActionMessage resource values.
Attack vector and prerequisites: The attack is conducted over the network (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). This makes it trivially exploitable by any attacker who can reach the application over HTTP.
Exploitation mechanism: When an application uses the Struts 1 plugin to bridge legacy Struts 1 actions within a Struts 2 framework, user-supplied field values can be injected into ActionMessage objects. The Struts 2 framework processes these values through its OGNL expression evaluator. By crafting a malicious field value containing OGNL expressions, an attacker forces the server to evaluate arbitrary code. The OGNL expression language provides access to Java runtime methods, enabling system command execution.
Affected versions: Apache Struts versions 2.3.1 through 2.3.32 are affected when the Struts 1 plugin is enabled and ActionMessage classes are used to process user input.
CVSS vector breakdown: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the combination of network accessibility, zero required privileges, and full impact across confidentiality, integrity, and availability results in the maximum base score of 9.8.
Frequently Asked Questions
What is CVE-2017-9791?
CVE-2017-9791 is a critical remote code execution vulnerability in the Struts 1 plugin for Apache Struts 2. It allows unauthenticated attackers to execute arbitrary code on the server by sending a specially crafted field value that gets processed as an OGNL expression through the ActionMessage class. The vulnerability carries a CVSS score of 9.8.
Which versions of Apache Struts are affected?
Apache Struts versions 2.3.1 through 2.3.32 are affected when the Struts 1 plugin is enabled. Applications that do not use the Struts 1 plugin are not vulnerable to this specific issue. The vulnerability is documented in the Apache Struts security bulletin S2-048.
How do I fix CVE-2017-9791?
Upgrade Apache Struts to a version that includes the S2-048 fix. If upgrading is not immediately possible, disable or remove the Struts 1 plugin if it is not required by your application. As an interim measure, ensure that user-controlled values are not passed directly as raw messages to ActionMessage objects, and deploy WAF rules to block OGNL injection attempts.
How severe is CVE-2017-9791?
CVE-2017-9791 is rated CRITICAL with a CVSS 3.1 score of 9.8 — the near-maximum severity rating. Its EPSS score of 94.24% places it in the 99.93rd percentile for exploitation likelihood. CISA confirmed active exploitation by adding it to the KEV catalog. Public exploits are readily available, making any unpatched Struts application an easy target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.