actively-exploited-vulnerabilityrapid-weaponizationproof-of-concept-releaseinternet-facing-service-vulnerability

Attackers Probe Apache Struts File Upload Flaws for Web Shell RCE

Active Exploitation · 3 sources · Updated 3mo ago · First seen Dec 11, 2024

Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities CVE-2024-53677 and CVE-2023-50164, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories.

Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts 2.5.33, 6.3.0.2, or 6.4.0 as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Dec 2, 2023 – Dec 11, 2024

Reported Jul 2, 20251y ago
Large-scale scanning and exploitation attempts hit CVE-2023-50164
The advisory reported ongoing large-scale scanning for CVE-2023-50164 and distinct attempts to deploy web shells through the flaw. These observations showed attackers moving from public research to active exploitation activity.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 11, 20242y ago
Apache discloses CVE-2024-53677 in Struts2
Apache disclosed CVE-2024-53677, a critical Struts2 path traversal flaw in file upload logic. The vulnerability could permit unauthorized file uploads to restricted directories and potentially lead to remote code execution.
Advisory: Exploitation attempts of critical Apache Struts vulnerability (CVE-2024-53677)
Dec 12, 20233y ago
Cisco begins investigating exposure to CVE-2023-50164
Cisco announced that it was investigating whether its products were exposed to CVE-2023-50164. The statement reflected vendor response activity following disclosure and PoC release.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 12, 20233y ago
First public PoC exploits for CVE-2023-50164 are released
The first public proof-of-concept exploits for CVE-2023-50164 were released. Their publication lowered the barrier for attackers to test and weaponize the Struts vulnerability.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 10, 20233y ago
First public write-up on CVE-2023-50164 appears
The first public technical write-up for CVE-2023-50164 was published, revealing exploitation details for the Struts file upload flaw. This increased public understanding of how the bug could be abused.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 7, 20233y ago
Apache releases patch for CVE-2023-50164
Apache released an update addressing CVE-2023-50164 in Struts. The fix covered a critical remote code execution issue affecting multiple Struts branches.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 2, 20233y ago
Researcher reports CVE-2023-50164 to Apache
Researcher Steven Seeley of Source Incite reported the Apache Struts vulnerability CVE-2023-50164. The flaw involved path traversal in file upload handling that could enable arbitrary file write and remote code execution.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Date unknown
Public PoC and exploitation attempts emerge for CVE-2024-53677
Public proof-of-concept code for CVE-2024-53677 was observed on GitHub, while SANS and mnemonic reported enumeration and exploitation attempts targeting vulnerable Struts systems. mnemonic said it had first-hand visibility into broad exploitation attempts against its customer base.
Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm Center

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Apache Struts S2-067 File Upload Path Traversal (CVE-2024-53677)Apache Struts S2-066 File Upload Path Traversal RCE (CVE-2023-50164)

Organizations

1 linked

Apache Software Foundation

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Mnemonic BlogNews · Jul 2, 2025

Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache StrutsOpen source ↗

Mnemonic BlogNews · Dec 20, 2024

Advisory: Exploitation attempts of critical Apache Struts vulnerability (CVE-2024-53677)Open source ↗

Handlers Diary FullNews

Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm CenterOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilityrapid-weaponizationproof-of-concept-releaseinternet-facing-service-vulnerability

Attackers Probe Apache Struts File Upload Flaws for Web Shell RCE

Active Exploitation · 3 sources · Updated 3mo ago · First seen Dec 11, 2024

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Dec 2, 2023 – Dec 11, 2024

Reported Jul 2, 20251y ago
Large-scale scanning and exploitation attempts hit CVE-2023-50164
The advisory reported ongoing large-scale scanning for CVE-2023-50164 and distinct attempts to deploy web shells through the flaw. These observations showed attackers moving from public research to active exploitation activity.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 11, 20242y ago
Apache discloses CVE-2024-53677 in Struts2
Apache disclosed CVE-2024-53677, a critical Struts2 path traversal flaw in file upload logic. The vulnerability could permit unauthorized file uploads to restricted directories and potentially lead to remote code execution.
Advisory: Exploitation attempts of critical Apache Struts vulnerability (CVE-2024-53677)
Dec 12, 20233y ago
Cisco begins investigating exposure to CVE-2023-50164
Cisco announced that it was investigating whether its products were exposed to CVE-2023-50164. The statement reflected vendor response activity following disclosure and PoC release.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 12, 20233y ago
First public PoC exploits for CVE-2023-50164 are released
The first public proof-of-concept exploits for CVE-2023-50164 were released. Their publication lowered the barrier for attackers to test and weaponize the Struts vulnerability.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 10, 20233y ago
First public write-up on CVE-2023-50164 appears
The first public technical write-up for CVE-2023-50164 was published, revealing exploitation details for the Struts file upload flaw. This increased public understanding of how the bug could be abused.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 7, 20233y ago
Apache releases patch for CVE-2023-50164
Apache released an update addressing CVE-2023-50164 in Struts. The fix covered a critical remote code execution issue affecting multiple Struts branches.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Dec 2, 20233y ago
Researcher reports CVE-2023-50164 to Apache
Researcher Steven Seeley of Source Incite reported the Apache Struts vulnerability CVE-2023-50164. The flaw involved path traversal in file upload handling that could enable arbitrary file write and remote code execution.
Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache Struts
Date unknown
Public PoC and exploitation attempts emerge for CVE-2024-53677
Public proof-of-concept code for CVE-2024-53677 was observed on GitHub, while SANS and mnemonic reported enumeration and exploitation attempts targeting vulnerable Struts systems. mnemonic said it had first-hand visibility into broad exploitation attempts against its customer base.
Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm Center

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Apache Struts S2-067 File Upload Path Traversal (CVE-2024-53677)Apache Struts S2-066 File Upload Path Traversal RCE (CVE-2023-50164)

Organizations

1 linked

Apache Software Foundation

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Mnemonic BlogNews · Jul 2, 2025

Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache StrutsOpen source ↗

Mnemonic BlogNews · Dec 20, 2024

Advisory: Exploitation attempts of critical Apache Struts vulnerability (CVE-2024-53677)Open source ↗

Handlers Diary FullNews

Exploit attempts inspired by recent Struts2 File Upload Vulnerability (CVE-2024-53677, CVE-2023-50164) - SANS Internet Storm CenterOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Attackers Probe Apache Struts File Upload Flaws for Web Shell RCE

How this story unfolded

Large-scale scanning and exploitation attempts hit CVE-2023-50164

Apache discloses CVE-2024-53677 in Struts2

Cisco begins investigating exposure to CVE-2023-50164

First public PoC exploits for CVE-2023-50164 are released

First public write-up on CVE-2023-50164 appears

Apache releases patch for CVE-2023-50164

Researcher reports CVE-2023-50164 to Apache

Public PoC and exploitation attempts emerge for CVE-2024-53677

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Actively Exploited Apache Struts File Upload Flaw Enables RCE

Apache Struts 2 Multipart Parser RCE Was Exploited in the Wild

Apache Struts 2 Denial-of-Service Vulnerability via File Leak in Multipart Request Processing

Attackers Probe Apache Struts File Upload Flaws for Web Shell RCE

How this story unfolded

Large-scale scanning and exploitation attempts hit CVE-2023-50164

Apache discloses CVE-2024-53677 in Struts2

Cisco begins investigating exposure to CVE-2023-50164

First public PoC exploits for CVE-2023-50164 are released

First public write-up on CVE-2023-50164 appears

Apache releases patch for CVE-2023-50164

Researcher reports CVE-2023-50164 to Apache

Public PoC and exploitation attempts emerge for CVE-2024-53677

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Actively Exploited Apache Struts File Upload Flaw Enables RCE

Apache Struts 2 Multipart Parser RCE Was Exploited in the Wild

Apache Struts 2 Denial-of-Service Vulnerability via File Leak in Multipart Request Processing