CVE-2017-9805: Apache Struts REST Plugin XStreamHandler Deserialization Remote Code Execution
Summary
CVE-2017-9805: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code... Affects org.apache.struts:struts2-rest-plugin across 2 version ranges.
>= 2.1.1, < 2.3.34
>= 2.5.0, < 2.5.13
Fixed in 2.3.34 or 2.5.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Struts REST Plugin is a component of the Apache Struts framework that allows developers to build RESTful web services. It uses XStream, a Java library for serializing and deserializing objects to and from XML, for deserialization. This vulnerability affects versions 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 of the Apache Struts REST Plugin. The plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Vulnerability Detail
The vulnerability in the Apache Struts REST Plugin arises from the lack of type filtering during deserialization of XML payloads. This allows an attacker to craft a malicious XML payload that, when deserialized by the plugin, can execute arbitrary code on the server. This can lead to a complete compromise of the affected system, enabling unauthorized access, data theft, or further attacks. The vulnerability has a CVSSv3 score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1.1, < 2.3.342.3.34 -
>= 2.5.0, < 2.5.132.5.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable or block access to the affected REST endpoints. This can be achieved by modifying the application's configuration or using network-level controls. However, this workaround should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The Apache Struts REST Plugin is vulnerable to a remote code execution vulnerability due to the lack of type filtering during deserialization. Upgrading to a fixed version of the plugin is the recommended solution. If immediate upgrade is not possible, disabling or blocking access to the affected REST endpoints can serve as a temporary workaround. It is crucial to take prompt action to mitigate the risk of exploitation. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-rest-plugin →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to a complete compromise of the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
Yes, there have been known exploits targeting this vulnerability. It is crucial to patch or upgrade the affected Apache Struts REST Plugin to mitigate the risk.
While there have been reports of active attacks exploiting this vulnerability in the past, it is always recommended to assume that the vulnerability is actively targeted until the affected systems are patched or upgraded.
In addition to upgrading or patching the Apache Struts REST Plugin, it is recommended to follow secure coding practices, implement proper input validation, and regularly update all software components to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-rest-plugin.
