CVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability
Description
CVE-2017-9805 is a high-severity deserialization of untrusted data vulnerability in the Apache Struts REST Plugin. The vulnerability exists because the REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, allowing attackers to achieve remote code execution by sending crafted XML payloads. CVE-2017-9805 affects Apache Struts versions 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.3% (99.9th percentile), exploitation is near certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | struts | >= 2.1.2, < 2.3.34; >= 2.5.0, < 2.5.13 |
| cisco | digital media manager | - |
| cisco | hosted collaboration solution | 10.5\(1\); 11.0\(1\); 11.5\(1\); 11.6\(1\) |
| cisco | media experience engine | 3.5; 3.5.2 |
| cisco | network performance analysis | - |
| cisco | video distribution suite for internet streaming | - |
| netapp | oncommand balance | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/100609(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039263(Broken Link, Third Party Advisory, VDB Entry)
- https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax(Vendor Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=1488482(Issue Tracking, Third Party Advisory, VDB Entry)
- https://cwiki.apache.org/confluence/display/WW/S2-052(Mitigation, Vendor Advisory)
- https://lgtm.com/blog/apache_struts_CVE-2017-9805(Broken Link)
- https://security.netapp.com/advisory/ntap-20170907-0001/(Third Party Advisory)
- https://struts.apache.org/docs/s2-052.html(Mitigation, Vendor Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2(Third Party Advisory)
- https://www.exploit-db.com/exploits/42627/(Exploit, Third Party Advisory, VDB Entry)
- https://www.kb.cert.org/vuls/id/112992(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
In Apache Struts, the deserialization vulnerability occurs because the REST Plugin's XStreamHandler deserializes incoming XML payloads using XStream without any type filtering or restrictions on which classes can be instantiated. This allows attackers to craft malicious serialized objects (gadget chains) that trigger arbitrary code execution during the deserialization process, completely compromising the application server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2017-9805 carries a CVSS 3.1 score of 8.1 (HIGH), representing a serious remote code execution threat against web applications built on Apache Struts. The vulnerability is remotely exploitable over the network without authentication and without user interaction, though the attack complexity is rated high due to the need to craft specific deserialization payloads. Successful exploitation results in high impact across confidentiality, integrity, and availability, allowing complete server compromise. The EPSS score of 94.3% indicates near-certain exploitation activity, making this one of the most actively targeted Apache Struts vulnerabilities. Organizations running affected Struts versions face immediate risk of complete application and server compromise through crafted XML requests to REST endpoints.
Exploit Maturity
CVE-2017-9805 has extensive exploit maturity with confirmed active exploitation in the wild. CISA has listed it in the Known Exploited Vulnerabilities catalog, confirming widespread targeting. Public exploit code is available via Exploit Database, providing a ready-to-use exploit for this deserialization vulnerability. The Apache Foundation specifically referenced this vulnerability class in its statement on the Equifax breach, highlighting the real-world consequences of unpatched Struts applications. The EPSS score of 94.3% (99.9th percentile) confirms near-certain exploitation activity, and organizations using affected Struts versions should treat remediation as an emergency priority.
Remediation
- Upgrade Apache Struts immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade to Apache Struts 2.3.34 or later for the 2.3.x branch, or 2.5.13 or later for the 2.5.x branch.
- If the REST Plugin is not required, remove it entirely from the Struts application deployment to eliminate the attack surface. If the plugin is needed, restrict the allowed content types by configuring Struts to only accept JSON and reject XML requests.
- Deploy a web application firewall (WAF) with rules to detect and block malicious XStream deserialization payloads targeting Struts REST endpoints as an interim mitigation.
- Review application logs for suspicious POST requests to REST endpoints containing XML payloads, particularly those with unusual Java class references or serialized object patterns that may indicate exploitation attempts.
- Audit all applications in your environment for Apache Struts dependencies, including those embedded in Cisco products (Digital Media Manager, Hosted Collaboration Solution, Media Experience Engine) and NetApp OnCommand Balance, and apply vendor-specific patches for those products.
Technical Details
CVE-2017-9805 is a deserialization of untrusted data vulnerability in the Apache Struts REST Plugin, affecting versions 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13. The vulnerability exists in the XStreamHandler, which uses XStream to deserialize incoming XML payloads from REST API requests without any type filtering or class restrictions. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network-accessible exploitation without authentication, though the high attack complexity reflects the need for crafted deserialization payloads. Attackers exploit this by sending XML payloads containing serialized Java objects that trigger a chain of method calls (gadget chain) during deserialization, ultimately leading to arbitrary command execution on the application server with the privileges of the Struts application process.
Frequently Asked Questions
Is CVE-2017-9805 being actively exploited?
Yes. CVE-2017-9805 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity. Public exploit code is widely available.
What products are affected by CVE-2017-9805?
CVE-2017-9805 affects Apache Struts versions 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13. Additionally affected are Cisco Digital Media Manager, Hosted Collaboration Solution, Media Experience Engine, and NetApp OnCommand Balance.
How do I fix CVE-2017-9805?
Upgrade Apache Struts to version 2.3.34 or later (2.3.x branch) or 2.5.13 or later (2.5.x branch). If the REST Plugin is not needed, remove it. If it is required, configure it to reject XML content types and accept only JSON.
How severe is CVE-2017-9805?
CVE-2017-9805 has a CVSS 3.1 score of 8.1 (HIGH) and an EPSS score of 94.3% (99.9th percentile). The vulnerability enables remote code execution on Apache Struts application servers through crafted XML payloads, representing one of the most actively targeted Struts vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.