Apache Struts 2 Multipart Parser RCE Was Exploited in the Wild
Active Exploitation · 4 sources · Updated 3mo ago · First seen Feb 24, 2021
Apache Struts 2 contained a remote code execution flaw, CVE-2017-5638, in the Jakarta Multipart parser that allowed attackers to run arbitrary commands by sending crafted HTTP file-upload headers, including malicious Content-Type, Content-Disposition, or Content-Length values. The vulnerability affected Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1, and the CVE record notes that exploitation was observed in the wild, including attacks using a Content-Type header containing a #cmd= string.
The Apache Software Foundation highlighted CVE-2017-5638 as one of the notable exploitation-related cases in its annual security reporting, which summarized hundreds of vulnerability reports handled across more than 340 Apache projects. ASF said its 2020 security operations processed 18,000 security-related emails down to 946 non-spam threads, tracked 376 new vulnerability reports across 101 top-level projects, and assigned 151 CVE identifiers from 341 closed reports, underscoring both the scale of Apache’s disclosure workload and the continued significance of high-impact flaws such as the Struts RCE.
