Actively Exploited Apache Struts File Upload Flaw Enables RCE
Active Exploitation · 2 sources · Updated 4mo ago · First seen Dec 20, 2024
Apache Struts developers released fixes for CVE-2024-53677, a critical vulnerability in the framework's file upload handling that can allow malicious file upload and remote code execution in applications using FileUploadInterceptor. The flaw affects Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.3.0.2, and has been assigned a CVSS 4.0 score of 9.5. Public proof-of-concept exploit code is available, and CSIRT.SK reported that the vulnerability is being actively exploited in the wild.
Apache's guidance points organizations to Struts 6.4.0 or later, but the vendor's file upload documentation indicates remediation is not limited to patching alone: affected applications must also update source code to adopt the framework's newer file upload mechanism. Defenders are advised to review network and security logs for signs of compromise, as exposed internet-facing Struts applications that still rely on the legacy upload interceptor face elevated risk of exploitation.
