{"id":"CVE-2017-9805","aliases":["EUVD-2018-0602","GHSA-gg9m-fj3v-r58c"],"status":"published","title":"REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99396,"percentile":0.99941,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2017-09-15T19:00:00Z","modified":"2026-10-24T10:31:06Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/struts2_rest_xstream","title":"Apache Struts 2 REST Plugin XStream RCE","type":"exploit","platform":"Linux,Python,Unix,Windows","date":"2017-09-05","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/struts2_rest_xstream"},{"source":"exploitdb","id":"EDB-42627","title":"Apache Struts 2.5 \u003c 2.5.12 - REST Plugin XStream Remote Code Execution","type":"remote","platform":"linux","date":"2017-09-06","url":"https://www.exploit-db.com/exploits/42627"},{"source":"pocgithub","id":"luc10/struts-rce-cve-2017-9805","title":"luc10/struts-rce-cve-2017-9805","date":"2017-09-06","url":"https://github.com/luc10/struts-rce-cve-2017-9805"},{"source":"pocgithub","id":"hahwul/struts2-rce-cve-2017-9805-ruby","title":"hahwul/struts2-rce-cve-2017-9805-ruby","date":"2017-09-07","url":"https://github.com/hahwul/struts2-rce-cve-2017-9805-ruby"},{"source":"pocgithub","id":"mazen160/struts-pwn_CVE-2017-9805","title":"mazen160/struts-pwn_CVE-2017-9805","date":"2017-09-09","url":"https://github.com/mazen160/struts-pwn_CVE-2017-9805"},{"source":"pocgithub","id":"Lone-Ranger/apache-struts-pwn_CVE-2017-9805","title":"Lone-Ranger/apache-struts-pwn_CVE-2017-9805","date":"2017-09-10","url":"https://github.com/Lone-Ranger/apache-struts-pwn_CVE-2017-9805"},{"source":"pocgithub","id":"0x00-0x00/-CVE-2017-9805","title":"0x00-0x00/-CVE-2017-9805","date":"2017-11-24","url":"https://github.com/0x00-0x00/-CVE-2017-9805"},{"source":"pocgithub","id":"BeyondCy/S2-052","title":"BeyondCy/S2-052","date":"2017-11-28","url":"https://github.com/BeyondCy/S2-052"},{"source":"pocgithub","id":"chrisjd20/cve-2017-9805.py","title":"chrisjd20/cve-2017-9805.py","date":"2017-12-04","url":"https://github.com/chrisjd20/cve-2017-9805.py"},{"source":"pocgithub","id":"UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-","title":"UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-","date":"2019-08-31","url":"https://github.com/UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-"},{"source":"pocgithub","id":"UbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit","title":"UbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit","date":"2019-09-02","url":"https://github.com/UbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit"},{"source":"pocgithub","id":"AvishkaSenadheera/CVE-2017-9805---Documentation---IT19143378","title":"AvishkaSenadheera/CVE-2017-9805---Documentation---IT19143378","date":"2020-05-12","url":"https://github.com/AvishkaSenadheera/CVE-2017-9805---Documentation---IT19143378"},{"source":"pocgithub","id":"wifido/CVE-2017-9805-Exploit","title":"wifido/CVE-2017-9805-Exploit","date":"2020-06-11","url":"https://github.com/wifido/CVE-2017-9805-Exploit"},{"source":"pocgithub","id":"rvermeulen/apache-struts-cve-2017-9805","title":"rvermeulen/apache-struts-cve-2017-9805","date":"2020-11-13","url":"https://github.com/rvermeulen/apache-struts-cve-2017-9805"},{"source":"pocgithub","id":"jongmartinez/-CVE-2017-9805-","title":"jongmartinez/-CVE-2017-9805-","date":"2020-11-28","url":"https://github.com/jongmartinez/-CVE-2017-9805-"},{"source":"pocgithub","id":"z3bd/CVE-2017-9805","title":"z3bd/CVE-2017-9805","date":"2021-03-05","url":"https://github.com/z3bd/CVE-2017-9805"},{"source":"pocgithub","id":"agent3137/CVE-2017-9805-Exploit","title":"agent3137/CVE-2017-9805-Exploit","date":"2021-04-04","url":"https://github.com/agent3137/CVE-2017-9805-Exploit"},{"source":"pocgithub","id":"Shakun8/CVE-2017-9805","title":"Shakun8/CVE-2017-9805","date":"2022-10-03","url":"https://github.com/Shakun8/CVE-2017-9805"},{"source":"pocgithub","id":"NoSpaceAvailable/CVE-2017-9805_example_build","title":"NoSpaceAvailable/CVE-2017-9805_example_build","date":"2025-12-13","url":"https://github.com/NoSpaceAvailable/CVE-2017-9805_example_build"},{"source":"pocgithub","id":"Fl5xia/CVE-2017-9805","title":"Fl5xia/CVE-2017-9805","date":"2026-01-04","url":"https://github.com/Fl5xia/CVE-2017-9805"},{"source":"pocgithub","id":"7s26simon/CVE-2017-9805-S2-052","title":"7s26simon/CVE-2017-9805-S2-052","date":"2026-02-28","url":"https://github.com/7s26simon/CVE-2017-9805-S2-052"},{"source":"pocgithub","id":"Experience-rookie/struts-s2-052-deserialization-rce-lab","title":"Experience-rookie/struts-s2-052-deserialization-rce-lab","date":"2026-03-16","url":"https://github.com/Experience-rookie/struts-s2-052-deserialization-rce-lab"},{"source":"nuclei","id":"CVE-2017-9805","title":"Apache Struts2 S2-052 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9805.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","fixed_in":["2.5.13","2.3.34"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1"},{"fixed":"2.3.34"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1"},{"fixed":"2.3.34"}]}],"versions":["2.1.2","2.1.6","2.1.8","2.1.8.1","2.2.1","2.2.1.1","2.2.3","2.2.3.1","2.3.1","2.3.1.1","2.3.1.2","2.3.12","2.3.14","2.3.14.1","2.3.14.2","2.3.14.3","2.3.15","2.3.15.1","2.3.15.2","2.3.15.3","2.3.16","2.3.16.1","2.3.16.2","2.3.16.3","2.3.20","2.3.20.1","2.3.20.3","2.3.24","2.3.24.1","2.3.24.3","2.3.28","2.3.28.1","2.3.29","2.3.3","2.3.30","2.3.31","2.3.32","2.3.33","2.3.4","2.3.4.1","2.3.7","2.3.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.13"}]}],"versions":["2.5","2.5.1","2.5.10","2.5.10.1","2.5.12","2.5.2","2.5.5","2.5.8"]}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"apache software foundation","product":"apache struts"},{"vendor":"cisco","product":"digital_media_manager"},{"vendor":"cisco","product":"hosted_collaboration_solution"},{"vendor":"cisco","product":"media_experience_engine"},{"vendor":"cisco","product":"network_performance_analysis"},{"vendor":"cisco","product":"video_distribution_suite_for_internet_streaming"},{"vendor":"netapp","product":"oncommand_balance"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://struts.apache.org/docs/s2-052.html","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1039263","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securityfocus.com/bid/100609","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488482","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report","web"]},{"url":"https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/42627/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lgtm.com/blog/apache_struts_CVE-2017-9805","tags":["x_refsource_MISC","x_transferred","Broken Link","article","web"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-052","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20170907-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.kb.cert.org/vuls/id/112992","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9805","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","tags":["advisory"]},{"url":"https://github.com/apache/struts/commit/19494718865f2fb7da5ea363de3822f87fbda26","tags":["web"]},{"url":"https://github.com/apache/struts/commit/6dd6e5cfb7b5e020abffe7e8091bd63fe97c10a","tags":["web"]},{"url":"https://web.archive.org/web/20170909031344/http://www.securityfocus.com/bid/100609","tags":["web"]},{"url":"https://web.archive.org/web/20170922053119/http://www.securitytracker.com/id/1039263","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20170907-0001","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/42627","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gg9m-fj3v-r58c"},{"url":"https://github.com/apache/struts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-9805","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2017-09-15T19:00:00Z","modified":"2025-10-21T23:55:34.589Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2018-0602","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2017-09-15T19:00:00Z","modified":"2025-10-21T23:55:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-gg9m-fj3v-r58c","title":"REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2018-10-16T19:37:56Z","modified":"2025-10-22T17:31:33Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2017-9805","title":"Apache Struts Deserialization of Untrusted Data Vulnerability","description":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","cwes":["CWE-502"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2017-9805","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2017-09-15T19:29:00.237Z","modified":"2026-06-17T01:28:57.493Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:03:59.716532Z"}],"osv":[{"id":"CVE-2017-9805","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2017-09-15T19:29:00.237Z","modified":"2026-10-24T10:31:06.866076251Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"GHSA-gg9m-fj3v-r58c","title":"REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering","description":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","status":"published","published":"2018-10-16T19:37:56Z","modified":"2025-10-22T19:13:04.007003Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}