CriticalPublic exploitVulnerability

CVE-2024-53677

Apache Struts S2-067 File Upload Path Traversal

Published Dec 11, 2024 · Updated 7 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS9.5Critical · v4

EPSS72.4%99th percentile

CISA KEVNoNot listed

In the wildReported6 exploitation records in Mallory

Vendor: Apache Software Foundation

IdentifiersCVE-2024-53677CWE-434 · Unrestricted Upload of File with…

CVE-2024-53677 is a file upload vulnerability in Apache Struts versions 2.0.0 before 6.4.0 affecting applications that use the legacy FileUploadInterceptor. Insufficient validation of upload parameters allows attackers to manipulate uploaded filenames and perform path traversal, placing malicious files in otherwise restricted directories. Remote code execution is possible when an uploaded file can be exposed and executed by the application server. Applications that do not use the legacy file upload mechanism are unaffected.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits unauthorized uploads into restricted directories and modification of the affected system. Uploading an executable server-side payload, such as a web shell, can enable arbitrary command execution. Remote code execution depends on the uploaded payload reaching a location where it can be invoked and executed. Active exploitation attempts and publicly available proof-of-concept exploits have been reported.

Mitigation

If you can’t patch tonight, do this now.

Disable file upload functionality where it is unnecessary, and apply WAF rules to help block malicious upload requests pending complete remediation. Review network and security logs for evidence of exploitation. These measures do not replace upgrading and migrating away from the legacy upload mechanism.

Remediation

Patch, then assume compromise.

Upgrade Apache Struts to version 6.4.0 or later and migrate to the new Action File Upload mechanism and its related interceptor. Upgrading the framework alone while retaining the legacy upload mechanism is insufficient. Migration is not backward compatible and requires corresponding application source changes, including rewriting affected actions and interceptor configurations.

Public exploits

Exploits

12 exploits validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 3 not yet analyzed, such as Exploit-DB entries.

View more in app →

s2-067-CVE-2024-53677This repository provides both a detection script and a working exploit for CVE-2024-53677 (Apache Struts 2 S2-067). The vulnerability allows attackers to exploit flawed file upload logic, enabling path traversal and potentially remote code execution by uploading malicious files (such as JSP webshells) to sensitive locations. - 'Check-CVE-2024-53677.py' is a non-destructive detection tool that tests if a target is vulnerable by attempting to overwrite a file name via crafted multipart form data. It does not exploit the vulnerability but checks for the possibility of path traversal in file uploads. - 's2-067-poc.py' is a full exploit that uploads a JSP webshell to arbitrary paths (using path traversal) via the vulnerable upload endpoint. The script supports uploading multiple files and verifies if the uploaded shell is accessible and can execute commands via the 'cmd' parameter. - The README.md provides background on the vulnerability, affected versions, and remediation advice. The exploit targets Apache Struts 2 installations with exposed file upload endpoints and not using the FileUploadInterceptor. The main attack vector is network-based, requiring HTTP access to the upload endpoint. The payload is a JSP webshell, enabling remote code execution if the exploit succeeds.cloudwafs · Disclosed Dec 12, 2024 · python · networkOperational CVE-2024-53677-S2-067This repository provides tools for detecting and exploiting CVE-2024-53677, a critical remote code execution vulnerability in Apache Struts (S2-067). The vulnerability allows attackers to perform path traversal and upload arbitrary files, such as web shells, to the server via a vulnerable file upload endpoint. The repository contains two main Python scripts: 1. Check-CVE-2024-53677.py: A non-destructive detection tool that attempts to upload a harmless file using path traversal to check for the vulnerability without causing harm. 2. S2-067.py: An exploit script that uploads a JSP web shell to a user-specified path (using path traversal), then verifies if the shell is accessible and can execute arbitrary commands via the 'cmd' parameter. The exploit targets Apache Struts versions 2.0.0-2.5.33 and 6.0.0-6.3.0.2, requiring the attacker to know the upload endpoint (e.g., /upload.action or /uploads.action). The payload is a JSP web shell, and the attack vector is network-based, exploiting HTTP file upload functionality. The repository is structured with clear separation between detection and exploitation scripts, and includes a README with detailed vulnerability and mitigation information.XiaomingX · Disclosed Dec 18, 2024 · python · networkOperational CVE-2024-53677This repository provides a working exploit for CVE-2024-53677, a file upload vulnerability in Apache Struts2 (versions 2.0.0 before 6.4.0) that can lead to remote code execution. The main exploit script, CVE-2024-53677.py, is a Python tool that uploads a malicious JSP webshell to a vulnerable Struts2 application's file upload endpoint (e.g., /upload.action). The payload is a JSP file that allows the attacker to execute arbitrary system commands via HTTP requests. The repository includes a full Docker-based lab environment with a vulnerable Struts2 application, supporting files for building and running the environment, and example payloads. The exploit requires the target to be running a vulnerable Struts2 version with the old file upload logic enabled. The attack vector is network-based, targeting accessible HTTP endpoints. The repository is well-structured for both exploitation and educational purposes, with clear documentation and usage instructions.EQSTLab · Disclosed Jan 3, 2025 · python · java · networkOperational Apache-struts-cve-2024-53677This repository contains a Python exploit script (exploit.py) and a README.md for CVE-2024-53677, a remote code execution vulnerability in Apache Struts (S2-067). The exploit targets a vulnerable file upload endpoint, allowing an attacker to upload arbitrary files (such as a JSP webshell) to a specified location on the server, potentially using path traversal. The script then verifies if the file is accessible and can execute arbitrary commands via the uploaded webshell by sending HTTP requests with command parameters. The exploit is operational, requiring the attacker to specify the target URL, upload endpoint, file(s) to upload, and the destination path. The README provides a brief description and references to a video PoC and the original vulnerability. No hardcoded endpoints are present; the script is designed to be used against any target with a vulnerable upload endpoint. The main attack vector is network-based, exploiting HTTP file upload functionality.punitdarji · Disclosed Jan 8, 2025 · python · networkOperational CVE-2024-53677This repository provides a full environment to reproduce and exploit CVE-2024-53677, a remote code execution vulnerability in Apache Struts 2 (version 6.3.0.1 as per the included pom.xml). The structure includes: - A vulnerable Struts 2 web application (Java source, JSPs, and configuration) that exposes a file upload endpoint (/upload.action) susceptible to path traversal, allowing arbitrary file upload outside the intended directory. - A Python exploit script (S2-067.py) that automates uploading a malicious file (such as shell.jsp) to the server using the vulnerable endpoint. The script supports specifying the upload endpoint, file(s) to upload, and the destination path (including traversal sequences like '../'). It verifies upload success and can interact with the uploaded shell for command execution. - A JSP webshell (shell.jsp) that executes system commands provided via the 'cmd' GET parameter, returning output in the HTTP response. - Dockerfile and OpenShift YAML for easy deployment of the vulnerable environment. The exploit's main capability is to achieve remote code execution by uploading a webshell via path traversal in the file upload functionality. The exploit is operational, as it provides a working payload and automation for exploitation. The repository is well-structured for both demonstration and testing of the vulnerability.SeanRickerd · Disclosed Jan 10, 2025 · python · java · networkOperational CVE-2024-53677-ExploitThis repository provides an operational exploit for CVE-2024-53677. It consists of a Python script (exploit.py) that automates the exploitation process and a JSP web shell (shell.jsp) used as the payload. The exploit works by uploading the shell.jsp file to a vulnerable server via a presumed file upload endpoint (/upload.action). Once uploaded, the shell can be accessed at /uploads/shell.jsp, where it allows the attacker to execute arbitrary system commands on the server by passing them as the 'cmd' parameter in HTTP requests. The Python script provides an interactive shell interface for the attacker, handling both the upload and command execution phases. The repository structure is straightforward: README.md (brief description), exploit.py (main exploit logic), and shell.jsp (payload). The exploit targets web servers that allow arbitrary file uploads and execute uploaded JSP files, and it requires the attacker to know or guess the correct upload and shell access endpoints.shishirghimir · Disclosed Feb 24, 2025 · python · jsp · networkOperational CVE-2024-53677This repository provides an operational exploit for CVE-2024-53677, a critical path traversal and remote code execution vulnerability in Apache Struts. The exploit consists of a Python script (exploit/exploit.py) that automates the attack by uploading a malicious JSP webshell (exploit/webshell.jsp) to a vulnerable Struts server via a manipulated file upload request. The script crafts a WAR archive containing the webshell, abuses path traversal in the upload parameters to place the shell in a web-accessible directory, and then provides an interactive shell interface to execute arbitrary commands on the compromised server. The repository also includes detailed manual exploitation instructions (manual-exploit.md, exploit/manual-exploit.md) and a requirements.txt for dependencies. The main attack vector is network-based, targeting HTTP file upload endpoints. The exploit is operational, providing a working webshell payload and an interactive command execution interface.r007sec · Disclosed Jun 3, 2025 · python · jsp · networkOperational CVE-2024-53677-POCThis repository is a proof-of-concept exploit for CVE-2024-53677, a path traversal and remote code execution vulnerability in Apache Struts. The main exploit logic is implemented in Go (main.go), which automates the process of uploading a malicious JSP webshell (webshell.jsp) to a vulnerable Struts server. The exploit attempts to discover the correct file path for upload using a test file, then uploads the webshell, and finally interacts with it to execute arbitrary commands or perform file operations. The webshell supports command execution, file upload, directory listing, and file deletion via HTTP parameters. The exploit is customizable via command-line flags for target URL, endpoint, payload, and parameters. The repository includes a README with usage instructions, a Go module file, a test file for path discovery, and the JSP webshell payload. The attack vector is network-based, targeting HTTP endpoints exposed by the vulnerable Struts application.Cythonic1 · Disclosed Sep 1, 2025 · go · jsp · networkOperational CVE-2024-53677This repository provides a full proof-of-concept and exploitation toolkit for CVE-2024-53677, a critical file upload vulnerability in Apache Struts2 (versions 2.0.0 through 6.3.x before 6.4.0). The repository includes: - Two main Python scripts: 'PoC.py' (a minimal exploit that uploads a JSP webshell and executes arbitrary commands) and 'cve_2024_53677_Tool.py' (a comprehensive tool with a menu-driven interface for detection, exploitation, and post-exploitation, including Docker integration and Selenium support). - A complete vulnerable Struts2 application (Java source, Maven project, and Docker deployment files) to facilitate local testing and demonstration of the exploit. - The exploit works by uploading a malicious JSP webshell to the '/upload.action' endpoint, exploiting a path traversal flaw to place the shell in a web-accessible location (e.g., '../test.jsp'). The attacker can then send HTTP requests to the webshell (e.g., '/test.jsp?action=cmd&cmd=id') to execute arbitrary system commands on the server. - The repository is well-structured for both demonstration and practical exploitation, with clear separation between exploit scripts, vulnerable application code, and deployment resources. This exploit is operational and provides a working webshell payload, but is not part of a larger exploitation framework. It is suitable for both security research and red team use against vulnerable Struts2 deployments.seoyoung-kang · Disclosed Oct 15, 2025 · python · java · networkOperational CVE-2024-53677This repository contains a Python exploit script (CVE‑2024‑53677.py) and a README file. The exploit targets CVE-2024-53677, a vulnerability in web applications that allows attackers to bypass file upload restrictions and deploy a JSP webshell. The script crafts a multipart POST request to the /upload.action endpoint, disguising the webshell as a JPEG image, and attempts to write it as '../../SHELL.jsp' on the server. After uploading, it checks if the webshell is accessible at /SHELL.jsp. If successful, the attacker gains a web interface to execute arbitrary system commands on the server. The exploit is operational and provides a working webshell payload. No hardcoded IPs or domains are present; the target URL is supplied via command-line argument. The repository is straightforward, with a single exploit script and a minimal README.MartinxMax · Disclosed Jan 2, 2026 · python · jsp · networkOperational cve-2024-53677This is a standalone, Docker-based vulnerable CTF laboratory with a working exploit implementation for CVE-2024-53677 (S2-067), rather than a framework module or detection-only script. Static inspection supports the exploit mechanism, but execution and successful exploitation were not independently verified. The 15 files comprise a Python exploit, a Java upload action, two JSP pages, two shell startup scripts, Docker/Maven/Struts/servlet configuration, two documentation files, and Git metadata configuration. Six files contain Python, Java/JSP, or shell source; the Dockerfile supplies additional build and deployment instructions. Maven pins struts2-core to 6.3.0.2 and builds ROOT.war. The Dockerfile builds with Maven and Java 17, then deploys on Tomcat 9.0.107. Compose exposes port 10022 to container port 8080. entrypoint.sh writes an environment-provided flag to /flag, makes it world-readable, clears flag environment variables, and drops privileges to appuser before starting Tomcat. exploit/exploit.py uses only Python's standard library. It generates a randomized JSP filename and constructs a multipart POST to /upload.action. The file part is named Upload, while a separate top.uploadFileName parameter supplies ../<shell>.jsp. The intended Struts parameter-binding behavior lets this navigation-prefixed parameter override the sanitized filename. UploadAction.execute then copies the file outside /uploads into the application web root without canonical-path validation. A subsequent GET supplies cmd to the uploaded JSP, which executes /bin/sh -c and returns stdout. The default command reads /flag; an optional command-line argument permits other commands. The payload is embedded and basic, making this OPERATIONAL under the requested maturity criteria. HTTP helpers use 15-second timeouts and disable HTTPS certificate validation. Success is inferred from HTTP 200 and nonempty output, not a dedicated vulnerability check. The script leaves the unauthenticated webshell behind and does not implement cleanup, stderr capture, privilege escalation, container escape, or external command-and-control. Documentation lists additional affected Struts version ranges and discusses CVE-2023-50164 as related history; the actual supplied target is 6.3.0.2. Documentation and XML schema URLs are references, not exploit callback endpoints. No original repository URL, Git reference, archive location, or archive size was supplied; the empty metadata and zero size represent unavailable information.choyj358 · Disclosed Oct 13, 2026 · python · java · web · networkOperational CVE-2024-53677This repository contains a proof-of-concept (POC) exploit for CVE-2024-53677, a file upload logic bypass vulnerability in Apache Struts2 (S2-067). The exploit is implemented in Python (s2-067.py) and allows an attacker to upload arbitrary files to a vulnerable Struts2 server by exploiting improper handling of file extensions and filename parameters. The script takes command-line arguments for the target upload URL, the filename to use (which can include path traversal), the file to upload (such as a webshell), and the upload type (single or multiple file upload). The README provides usage instructions and highlights the vulnerability conditions. The main attack vector is network-based, targeting HTTP file upload endpoints. The only fingerprintable endpoint in the repository is the example URL 'http://localhost:28080/uploadFile'. The exploit does not include a payload itself but allows the user to supply any file, typically a JSP webshell, to achieve remote code execution if the server is vulnerable.yangyanglo · Disclosed Dec 17, 2024 · python · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationStrutsapplication

External references

References

MITRE CVEcve.org · CVE-2024-53677 NVDnvd.nist.gov/vuln/detail/CVE-2024-53677 MITRE CWE · CWE-434Unrestricted Upload of File with Dangerous Type Third Party Advisorycwiki.apache.org/confluence/display/WW/S2-067 Third Party Advisorysecurity.netapp.com/advisory/ntap-20250103-0005

Activity feed

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

nuclei templates pull requestsNews · Oct 9, 2026feat(cve): add CVE-2024-53677 template - Apache Struts 2 File Upload RCE (S2-067) by mumusama75 · Pull Request #17389 · projectdiscovery/nuclei-templatesAn Apache Struts vulnerability identified as S2-067. The content concerns adding a security-testing template and shows a traversal-style upload filename, but does not establish exploitation impact or operational activity.Read more ↗nuclei templates pull requestsNews · Feb 15, 2026Add CVE-2024-53677 - Apache Struts S2-067 File Upload Path Traversal by Bushi-gg · Pull Request #15329 · projectdiscovery/nuclei-templates · GitHubA specific Apache Struts vulnerability (S2-067) described as a file upload path traversal issue.Read more ↗cloudatg insightsNews · Feb 13, 2026AI Development & Software Engineering | CloudATGA critical Apache Struts vulnerability with reported exploitation attempts that could enable remote code execution.Read more ↗infosec writeupsNews · Jul 31, 2025HTB — Strutted Writeup: Linux MachineA remote code execution vulnerability in Apache Struts2 (v6.3.0.1) due to insufficient validation of the uploadFileName parameter, allowing path traversal and arbitrary file upload to sensitive directories.Read more ↗

+7 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signatures3YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.