Flawed File Upload Logic in Apache Struts Exposes Vulnerability
CVE-2024-53677

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Struts
Vendor: CVE Published:; 11 December 2024

Badges

🥇 Trended No. 1📈 Trended📈 Score: 7,000💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2024-53677?

CVE-2024-53677 is a critical security vulnerability found in Apache Struts, an open-source framework widely used for developing web applications in Java. This flaw occurs in the file upload functionality of Apache Struts, allowing attackers to exploit the way file uploads are handled. If successfully exploited, this vulnerability can lead to serious consequences, including the unsolicited execution of malicious code on the server, which can compromise the integrity and security of the affected applications and systems.

Technical Details

The vulnerability arises from flawed logic in the file upload process within Apache Struts, specifically affecting versions from 2.0.0 up to but not including 6.4.0. Attackers may manipulate certain parameters during file uploads, enabling path traversal attacks. This manipulation can permit the upload of malicious files that, when executed, allow unauthorized remote code execution. Organizations relying on older versions of the framework without the new file upload mechanisms are particularly at risk.

Potential Impact of CVE-2024-53677

Remote Code Execution: The most severe impact of this vulnerability is the potential for remote code execution. An attacker could upload and execute malicious scripts, gaining control over the affected server.
Data Breach and Integrity Compromise: Exploitation could lead to unauthorized access to sensitive data, resulting in breaches that could significantly affect organizations' operations and reputations.
Service Disruption: Successful exploitation might enable attackers to disrupt normal service functionality, leading to downtime or loss of service availability, which can severely impact business continuity and customer trust.

Affected Version(s)

Apache Struts 2.0.0 < 6.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-53677-Docker
Created by c4oocO

CVE-2024-53677-S2-067
Created by XiaomingX

CVE-2024-53677
Created by SeanRickerd

News Articles

Sonatype

CVE-2024-53677

CVE-2024-53677: A critical file upload vulnerability in Apache Struts2

Learn how to address CVE-2024-53677, a critical Apache Struts2 vulnerability. Discover mitigation steps to secure your software supply chain.

4 weeks ago

CVE-2024-53677

Orgs Scramble to Fix Actively Exploited Bug in Struts 2

A newly discovered vulnerability, CVE-2024-53677, in the aging Apache framework is going to cause major headaches for IT teams, since patching isn't enough to fix it.

4 weeks ago