Is CVE-2017-9805 exploited in the wild?

Yes. CVE-2017-9805 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

How severe is CVE-2017-9805?

Critical severity, with a CVSS score of 3, published 16 October 2018.

Which products and versions are affected?

org.apache.struts:struts2-rest-plugin (Maven) ECOSYSTEM:introduced=2.1.1,fixed=2.3.34.

Is there a fix for CVE-2017-9805?

Yes. org.apache.struts:struts2-rest-plugin (Maven): upgrade to 2.3.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-9805 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-9805?

Check whether you run Apache Struts or org.apache.struts:struts2-rest-plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-9805: REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

CVE-2017-9805 · Severity: critical · CVSS 3 · Exploited in the wild · Published 2018-10-16

The REST Plugin in Apache Struts uses an XStreamHandler for deserialization without proper type filtering. This vulnerability allows remote attackers to execute arbitrary code by sending specially crafted XML payloads.

Technologies: Apache Struts, org.apache.struts:struts2-rest-plugin (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2017-9805 exploited in the wild?: Yes. CVE-2017-9805 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2017-9805?: Critical severity, with a CVSS score of 3, published 16 October 2018.
Which products and versions are affected?: org.apache.struts:struts2-rest-plugin (Maven) ECOSYSTEM:introduced=2.1.1,fixed=2.3.34.
Is there a fix for CVE-2017-9805?: Yes. org.apache.struts:struts2-rest-plugin (Maven): upgrade to 2.3.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-9805 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-9805?: Check whether you run Apache Struts or org.apache.struts:struts2-rest-plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.struts:struts2-rest-plugin (Maven): upgrade to 2.3.34 or later

# set org.apache.struts:struts2-rest-plugin to 2.3.34 in your pom.xml or build.gradle

Affected products

Apache Struts REST Plugin 2.1.1 through 2.3.33, 2.5.x before 2.5.13

Identifiers

CVE-2017-9805
GHSA-gg9m-fj3v-r58c

Timeline

2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2021-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.