Loading vulnerability…
Remote code execution in Apache Struts FreeMarker tags (S2-053)
CVE-2017-12611 is an expression-injection vulnerability affecting Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1. Applications that use expression literals or force expression evaluation in FreeMarker tags, rather than using string literals, can expose attacker-controlled request values to expression evaluation, enabling remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote code execution in the affected Apache Struts application. The resulting access and capabilities depend on the application's execution privileges.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure by auditing and correcting Freemarker tag usage that relies on expression literals or forced expressions, especially where request-supplied values can reach tag attributes. Limit external access to affected Struts applications where feasible, apply compensating controls such as strict request filtering and web application firewall rules for exploit attempts, and monitor for abnormal expression evaluation or command execution behavior in application logs.
Patch, then assume compromise.
Upgrade Apache Struts to version 2.3.34 or later in the 2.3.x branch, or version 2.5.11 or later in the 2.5.x branch.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.