Vulnerability CVE-2017-5638 - CERT Civis.Net

Vulnerability Name:

CVE-2017-5638 (CCN-122776)

Assigned:

2017-03-06

Published:

2017-03-06

Updated:

2021-02-24

Summary:

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVSS v3 Severity:

10.0 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
9.3 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
9.3 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MISC
Type: Technical Description, Third Party Advisory
http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html

Source: MISC
Type: Technical Description, Third Party Advisory
http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/

Source: MITRE
Type: CNA
CVE-2017-5638

Source: CONFIRM
Type: UNKNOWN
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt

Source: MISC
Type: Press/Media Coverage
http://www.eweek.com/security/apache-struts-vulnerability-under-attack.html

Source: CCN
Type: IBM Security Bulletin S1010105 (FlashSystem 840)
A vulnerability in Apache Struts affects the IBM FlashSystem models 840 and 900

Source: CCN
Type: IBM Security Bulletin S1010106 (FlashSystem V840)
A vulnerability in Apache Struts affects the IBM FlashSystem model V840

Source: CCN
Type: IBM Security Bulletin S1010113 (Storwize V7000 (2076))
Vulnerability in Apache Struts affects SAN Volume Controller, Storwize family and FlashSystem V9000 products (CVE-2017-5638)

Source: CCN
Type: IBM Security Bulletin S1010384 (Storwize V7000 Unified (2073))
ulnerability in Apache Struts affects Storwize V7000 Unified (CVE-2017-5638)

Source: CCN
Type: IBM Security Bulletin 2000444 (Connections)
Remote Code Execution (RCE) Vulnerability in Apache Struts affects IBM Connections

Source: CCN
Type: IBM Security Bulletin 2001388 (Opportunity Detect)
Vulnerability in Apache Struts affects IBM Opportunity Detect (CVE-2017-5638)

Source: CCN
Type: IBM Security Bulletin 2001731 (Social Media Analytics)
Vulnerability in Apache Struts affects IBM Social Media Analytics (CVE-2017-5638)

Source: CCN
Type: IBM Security Bulletin 2001736 (Sterling Order Management)
IBM Sterling Order Management is affected by a vulnerability (CVE-2017-5638)

Source: CCN
Type: US-CERT VU#834067
Apache Struts 2 is vulnerable to remote code execution

Source: CCN
Type: Oracle CPUApr2017
Oracle Critical Patch Update Advisory - April 2017

Source: CCN
Type: Oracle CPUJul2017
Oracle Critical Patch Update Advisory - July 2017

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: BID
Type: Third Party Advisory, VDB Entry
96729

Source: CCN
Type: BID-96729
Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1037973

Source: MISC
Type: Press/Media Coverage
https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/

Source: CCN
Type: Apache Struts 2 Documentation S2-045
Possible Remote Code Execution when performing file upload based on Jakarta Multipart parser

Source: CONFIRM
Type: Mitigation, Vendor Advisory
https://cwiki.apache.org/confluence/display/WW/S2-045

Source: CONFIRM
Type: UNKNOWN
https://cwiki.apache.org/confluence/display/WW/S2-046

Source: XF
Type: UNKNOWN
apache-struts-cve20175638-code-exec(122776)

Source: EXPLOIT-DB
Type: Exploit, VDB Entry
41570

Source: CONFIRM
Type: Patch
https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=352306493971e7d5a756d61780d57a76eb1f519a

Source: CONFIRM
Type: Patch
https://git1-us-west.apache.org/repos/asf?p=struts.git;a=commit;h=6b8272ce47160036ed120a48345d9aa884477228

Source: MISC
Type: Exploit
https://github.com/mazen160/struts-pwn

Source: MISC
Type: Exploit
https://github.com/rapid7/metasploit-framework/issues/8064

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03733en_us

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03749en_us

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us

Source: MISC
Type: Technical Description, Third Party Advisory
https://isc.sans.edu/diary/22169

Source: MLIST
Type: UNKNOWN
[announce] 20210223 Re: Apache Software Foundation Security Report: 2020

Source: MLIST
Type: UNKNOWN
[announce] 20200131 Apache Software Foundation Security Report: 2019

Source: MLIST
Type: UNKNOWN
[announce] 20210125 Apache Software Foundation Security Report: 2020

Source: MISC
Type: Third Party Advisory
https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html

Source: CCN
Type: Packet Storm Security [03-07-2017]
Struts2 S2-045 Remote Command Execution

Source: MISC
Type: Exploit, VDB Entry
https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt

Source: CCN
Type: Packet Storm Security [03-10-2017]
Apache Struts 2 2.3.x / 2.5.x Remote Code Execution

Source: CCN
Type: Packet Storm Security [03-14-2017]
Apache Struts Jakarta Multipart Parser OGNL Injection

Source: CONFIRM
Type: UNKNOWN
https://security.netapp.com/advisory/ntap-20170310-0001/

Source: CONFIRM
Type: UNKNOWN
https://struts.apache.org/docs/s2-045.html

Source: CONFIRM
Type: UNKNOWN
https://struts.apache.org/docs/s2-046.html

Source: CONFIRM
Type: UNKNOWN
https://support.lenovo.com/us/en/product_security/len-14200

Source: CCN
Type: Cisco Security Advisory cisco-sa-20170310-struts2
Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products

Source: MISC
Type: Third Party Advisory
https://twitter.com/theog150/status/841146956135124993

Source: CCN
Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY
KNOWN EXPLOITED VULNERABILITIES CATALOG

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [03-15-2017]

Source: EXPLOIT-DB
Type: UNKNOWN
41614

Source: MISC
Type: UNKNOWN
https://www.imperva.com/blog/2017/03/cve-2017-5638-new-remote-code-execution-rce-vulnerability-in-apache-struts-2/

Source: CERT-VN
Type: UNKNOWN
VU#834067

Source: CONFIRM
Type: UNKNOWN
https://www.symantec.com/security-center/network-protection-security-advisories/SA145

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:struts:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.13:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.17:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.19:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.21:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.22:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.23:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.25:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.26:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.27:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.28:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.28.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.29:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.30:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.31:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:apache:struts:2.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.10:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:struts:2.3.8:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.12:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.16.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.30:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.5:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.28.1:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.29:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.31:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.9:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.11:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.14.3:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.15:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.17:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.19:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.20.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.21:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.22:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.23:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.24.2:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.25:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.26:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.3.27:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.16:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.4:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.6:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.7:*:*:*:*:*:*:*

OR cpe:/a:apache:struts:2.5.9:*:*:*:*:*:*:*

AND

cpe:/a:ibm:connections:4.5:*:*:*:*:*:*:*

OR cpe:/a:cisco:identity_services_engine:-:*:*:*:*:*:*:*

OR cpe:/a:ibm:connections:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:connections:5.0:*:*:*:*:*:*:*

OR cpe:/a:cisco:prime_service_catalog:10.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_unified_software:1.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:connections:5.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:webcenter_sites:12.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_unified_software:1.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.7:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:12.2.1.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_data_integration_hub:8.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_profitability_management:6.1.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_profitability_management:8.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_funds_transfer_pricing:8.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_asset_liability_management:8.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_analytical_applications_reconciliation_framework:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_analytical_applications_reconciliation_framework:8.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_analytical_applications_reconciliation_framework:8.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:webcenter_sites:12.2.1.2.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_analytical_applications_infrastructure:7.3.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:financial_services_analytical_applications_infrastructure:7.3.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql_enterprise_monitor:3.1.6.8003:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql_enterprise_monitor:3.2.1182:*:*:*:*:*:*:*

OR cpe:/a:oracle:mysql_enterprise_monitor:3.3.2.1162:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20175638000	V	CVE-2017-5638 on Ubuntu 12.04 LTS (precise) - medium.	2017-03-10
oval:com.ubuntu.trusty:def:20175638000	V	CVE-2017-5638 on Ubuntu 14.04 LTS (trusty) - untriaged.	2017-03-10