CVE-2017-5638: Apache Struts Remote Arbitrary Command Execution
Summary
CVE-2017-5638: Apache Struts vulnerable to remote arbitrary command execution due to improper input validation. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.3.0, < 2.3.32
>= 2.5.0, < 2.5.10.1
Fixed in 2.3.32 or 2.5.10.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The vulnerable package, org.apache.struts:struts2-core, is a core component of Apache Struts. It is widely used in various web applications and provides functionality for handling file uploads. However, versions prior to 2.3.32 and 2.5.10.1 of Apache Struts contain a critical vulnerability that allows remote attackers to execute arbitrary commands on the server.
Vulnerability Detail
The vulnerability in Apache Struts arises from improper input validation during file-upload attempts using the Jakarta Multipart parser. The framework mishandles exceptions and generates error messages incorrectly, enabling remote attackers to execute arbitrary commands. This can be achieved by crafting a malicious Content-Type, Content-Disposition, or Content-Length HTTP header. In March 2017, this vulnerability was exploited in the wild using a Content-Type header containing a #cmd= string. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 10.0.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.322.3.32 -
>= 2.5.0, < 2.5.10.12.5.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, it is advised to disable the Jakarta Multipart parser in the Apache Struts configuration. This can be achieved by modifying the struts.xml file and removing or commenting out the following line: <constant name="struts.multipart.parser" value="jakarta"/>. However, this workaround may impact the functionality of file uploads in the application.
Conclusion
The vulnerability in Apache Struts (CVE-2017-5638) allows remote attackers to execute arbitrary commands on the server. To mitigate this risk, it is crucial to upgrade to a fixed version of Apache Struts. Additionally, disabling the Jakarta Multipart parser can serve as a temporary workaround, but it may affect file upload functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architecture.
The vulnerability allows remote attackers to execute arbitrary commands on the server. This can lead to unauthorized access, data theft, and potential compromise of the entire system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading to a fixed version of Apache Struts (2.3.32 or later for versions prior to 2.3.32, and 2.5.10.1 or later for versions prior to 2.5.10.1) will fix this vulnerability.
A workaround is to disable the Jakarta Multipart parser in the Apache Struts configuration. However, this may impact the functionality of file uploads in the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
