CriticalPublic exploitVulnerability

CVE-2023-50164

Apache Struts S2-066 File Upload Path Traversal RCE

Published Dec 7, 2023 · Updated 25 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS9.8Critical · v3.1

EPSS80.8%100th percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendor: Apache Software Foundation

IdentifiersCVE-2023-50164CWE-22

CVE-2023-50164, tracked by Apache Struts as S2-066, is a path-traversal vulnerability in Apache Struts file-upload handling. Improper processing of attacker-controlled upload filename parameters can permit traversal outside the intended upload location and arbitrary file writes. Under deployment-specific conditions, an attacker can use this behavior to upload a malicious server-side file, such as a JSP web shell, to a web-accessible location and execute code on the affected server. Affected releases include Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.32, and 6.0.0 through 6.3.0.1.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow an attacker to write a malicious server-side file outside the intended upload directory. If that file is placed at a valid remotely reachable route and executed by the application server, the attacker can obtain arbitrary code execution on the affected Struts server, including the ability to deploy a web shell.

Mitigation

If you can’t patch tonight, do this now.

Until fixed versions can be deployed, restrict Internet and untrusted-network access to web interfaces that expose Struts upload functionality. Place a web application firewall in front of exposed interfaces and monitor application servers for unexpected JSP file creation or execution, especially in sensitive or web-accessible directories.

Remediation

Patch, then assume compromise.

Upgrade Apache Struts to version 2.5.33 or later for the 2.5.x branch, or version 6.3.0.2 or later for the 6.x branch. The fixed releases are intended as drop-in replacements.

Public exploits

Exploits

8 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.

View more in app →

CVE-2023-50164-Apache-Struts-RCEThis repository provides a full proof-of-concept (PoC) exploit for CVE-2023-50164, a critical path traversal and remote code execution vulnerability in Apache Struts. The structure includes: - `exploit/` directory: Contains the main exploit script (`exploit.py`), a requirements file, and a JSP webshell. The Python script automates the exploitation process by uploading a malicious WAR file (containing the webshell) to a vulnerable Struts application's file upload endpoint. After successful upload, it provides an interactive shell to the attacker via the webshell. - `struts-app/` directory: Contains a demo vulnerable Struts application, including Java source code, JSP pages, and configuration files. This app is used to demonstrate the exploit in a controlled environment. - `Vagrantfile`: Automates the setup of a test environment with Tomcat and the vulnerable app, making it easy to reproduce the exploit. The exploit works by abusing the file upload functionality to perform path traversal, allowing the attacker to write a WAR file to the Tomcat webapps directory. Once deployed, the WAR exposes a JSP webshell accessible over HTTP, enabling arbitrary command execution on the server. The repository is well-structured for both demonstration and testing, and the exploit is operational, providing a working payload and interactive shell. The main attack vector is network-based, targeting exposed file upload endpoints on vulnerable Struts installations.jakabakos · Disclosed Dec 13, 2023 · python · java · networkOperational CVE-2023-50164This repository contains a functional exploit for CVE-2023-50164, a path traversal vulnerability in Apache Struts 2's file upload mechanism. The exploit is implemented in Python and consists of two main scripts: 'exploit.py' (the main orchestrator) and 'upload.py' (handles the file upload and verification). The exploit works by crafting a malicious file upload request to the '/upload.action' endpoint, using directory traversal in the filename to place a JSP web shell ('web_shell.jsp') in a web-accessible directory. The payload is a JSP web shell that allows remote command execution via the 'cmd' parameter. The exploit targets a default URL ('http://strutted.htb/'), but this can be modified. The repository also includes a 'requirements.txt' for dependencies and a detailed README.md explaining the vulnerability, exploitation steps, and ethical usage. The exploit is operational and provides a working web shell if the target is vulnerable and unpatched.Pixel-DefaultBR · Disclosed Mar 5, 2025 · python · networkOperational CVE-2023-50164-HTB-struttedThis repository provides a full proof-of-concept (PoC) exploit for CVE-2023-50164, a critical remote code execution vulnerability in Apache Struts related to unsafe file upload handling. The structure includes: - `exploit/exploit.py`: The main exploit script, written in Python, which crafts and uploads a malicious WAR file containing a JSP webshell to a vulnerable Struts application's file upload endpoint. It then provides an interactive shell to execute arbitrary commands via the webshell. - `exploit/webshell.jsp`: A simple JSP webshell that executes system commands received via the 'cmd' HTTP GET parameter. - `exploit/requirements.txt`: Python dependencies for the exploit script. - `struts-app/`: A demo vulnerable Struts application, including Java source code (`Upload.java`), configuration files (`struts.xml`, `web.xml`), and JSP pages for upload, success, and error handling. This app is used to demonstrate the vulnerability in a controlled environment. - `Vagrantfile`: Automates the setup of a vulnerable environment using Vagrant, provisioning a Debian VM with Tomcat, Maven, and the vulnerable Struts app. The exploit's main capability is to achieve remote code execution by exploiting the file upload vulnerability to deploy a webshell. The exploit is operational and provides an interactive shell if successful. The repository is intended for educational and testing purposes only, as stated in the README.MKIRAHMET · Disclosed Sep 4, 2025 · python · java · networkOperational CVE-2023-50164This repository contains a Python exploit script (exploit.py) targeting CVE-2023-50164, a critical path traversal vulnerability in Apache Struts (versions 2.0.0–2.5.32 and 6.0.0–6.3.0.1). The exploit allows an attacker to upload a webshell to the server by abusing a vulnerable file upload endpoint (such as /upload.action), leading to remote command execution (RCE). The script provides a menu-driven interface for version detection (including Docker-based checks), vulnerability checking, webshell upload, and webshell interaction (optionally via Selenium for browser automation). The only other file is a minimal README.md. The exploit requires the attacker to specify the target upload URL and optionally a Docker container name for local testing. The main attack vector is network-based, targeting HTTP endpoints. The script logs its activity to a local file (struts_exploit.log). No hardcoded credentials or IPs are present, but the default example endpoint is http://localhost:8080/upload.action. The exploit is operational, providing a working webshell payload and interactive exploitation features.hybinn · Disclosed Oct 9, 2025 · python · networkOperational cve-2023-50164-pocThis repository is a Go-based proof-of-concept (PoC) exploit for CVE-2023-50164, a vulnerability affecting Apache Struts and potentially other Java servlet containers that allow unsafe file upload handling. The exploit automates the process of uploading an arbitrary file (such as a web shell) to a target server by compressing the file into a WAR archive and sending it to a user-specified upload endpoint. The tool supports path traversal to reach web-accessible directories and can adapt to Windows or Unix-like file paths. The main entry point is 'main.go', which orchestrates the payload creation, upload, and verification steps. The exploit requires the attacker to provide the upload endpoint URL, the file to upload, and the target directory path. The README provides detailed usage instructions and example commands. The codebase is modular, with separate packages for payload construction, WAR file generation, and utility functions. No hardcoded endpoints are present; all targets are user-supplied at runtime. The exploit is a functional PoC and does not include weaponized or framework-level automation.dwisiswant0 · Disclosed Dec 17, 2023 · go · networkPoC CVE-2023-50164-POCThis repository is a Proof of Concept (PoC) for CVE-2023-50164, a path traversal vulnerability in Apache Struts (struts2-core 6.3.0.1) that can lead to remote code execution (RCE) via malicious file uploads. The project is a Maven-based Java web application with two main upload endpoints: one vulnerable (Upload.java) and one patched (UploadNoVuln.java). The vulnerable endpoint allows an attacker to upload a file to an arbitrary location by manipulating the 'uploadFileName' parameter, enabling the placement of a JSP webshell (e.g., 'rogue.jsp') in the web root. The exploit is demonstrated by uploading 'payload/rogue.jsp' and accessing it via the web server, confirming code execution. The repository includes all necessary configuration and documentation to run the PoC with or without the vulnerability, and clearly distinguishes between the vulnerable and fixed behaviors. The main attack vector is network-based, targeting the HTTP file upload endpoint. The PoC does not include a weaponized payload but demonstrates the exploitability of the vulnerability.snyk-labs · Disclosed Dec 30, 2023 · java · xml · networkPoC CVE-2023-50164-PoCThis repository is a Proof-of-Concept (PoC) exploit for CVE-2023-50164, a path traversal to remote code execution vulnerability in Apache Struts2. The repository contains a vulnerable Struts2 web application (Java, JSP) and an exploit script. The exploit works by packaging a malicious JSP webshell into a WAR file and uploading it to the vulnerable application via a crafted HTTP POST request to the '/upload-1.0.0/upload.action' endpoint. Once uploaded, the webshell is accessible at '/webshell/webshell.jsp', allowing the attacker to execute arbitrary system commands via the 'cmd' parameter. The repository includes Docker support for easy setup of the vulnerable environment. The main exploit logic is in 'exploit/exploit.sh' (for uploading the webshell) and 'exploit/webshell.jsp' (the webshell itself). The structure is typical for a PoC: it demonstrates the vulnerability and provides a working exploit, but does not include advanced features or automation beyond the basic attack flow.sunnyvale-it · Disclosed Jan 12, 2024 · java · jsp · networkPoC CVE-2023-50164-PoCThis repository is a Proof-of-Concept (PoC) exploit for CVE-2023-50164, a file path traversal vulnerability in Apache Struts2. The repository contains a vulnerable Java web application (StrutsUploadApp) built with Maven and Struts2 (version 6.3.0.1), along with Docker files for easy deployment. The main exploit script, exploit.py, is written in Python and automates the exploitation process by uploading an arbitrary file (such as a webshell) to the server using a crafted POST request to the /upload.action endpoint. The exploit leverages path traversal in the file upload parameter to place the file in a web-accessible directory (e.g., webapps/ROOT/), enabling remote access or code execution. The repository structure includes the vulnerable app's source code, configuration files, JSP pages for the web interface, and the exploit script. The exploit is operational as a PoC and demonstrates the risk of arbitrary file upload and potential remote code execution on unpatched Struts2 installations.NikitaPark · Disclosed Oct 6, 2024 · python · java · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationStrutsapplication

External references

References

MITRE CVEcve.org · CVE-2023-50164 NVDnvd.nist.gov/vuln/detail/CVE-2023-50164 MITRE CWE · CWE-22cwe.mitre.org Patchlists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj Third Party Advisorypacketstormsecurity.com/files/176157/Struts-S2-066-File-Upload-Remote-Code-Execution.html Third Party Advisorysecurity.netapp.com/advisory/ntap-20231214-0010 Mailing Listopenwall.com/lists/oss-security/2023/12/07/1

Activity feed

Recent activity

17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

nuclei templates pull requestsNews · Sep 29, 2026Add CVE-2023-50164 (Apache Struts S2-066 path traversal file upload RCE) by ArjunSecurin · Pull Request #17343 · projectdiscovery/nuclei-templatesAn Apache Struts S2-066 vulnerability involving path traversal through file-upload handling that can enable remote code execution.Read more ↗cloudatg insightsNews · Feb 13, 2026AI Development & Software Engineering | CloudATGA previously disclosed Apache Struts vulnerability referenced for similarity to CVE-2024-53677.Read more ↗detections digest rulecheckNews · Dec 1, 2025Detections Digest #20251201A path traversal vulnerability in Apache Struts (CVE-2023-50164) that can be exploited to upload a web shell via a malicious POST request, leading to remote code execution on affected Tomcat servers.Read more ↗mnemonic blogNews · Jul 2, 2025Advisory - CVE-2023-50164 - Critical RCE vulnerability in Apache StrutsA critical remote code execution vulnerability in Apache Struts caused by a path traversal issue in file upload parameters that can allow arbitrary file write and execution of malicious server-side files such as JSP web shells.Read more ↗

+7 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malware1Malware families linked to this CVE, with evidence and IOCs.

Detection signatures4YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity1Community discussion across Reddit, Mastodon, and other social sources.