CVE-2017-9805 Apache Struts
| Affected software | Apache Struts |
|---|---|
| Severity | 8.1 High CVSS 3.1 3 scores |
| Fixed in | 2.3.34, 2.5.13 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 15 Sep 2017 |
| Updated | 13 Nov 2026 |
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 9 citations · honeypot sightings · 20 exploits · earliest 2021-11-03.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 21 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2017-09-06.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-9805 in VulnCheck (free account), which lists 4 more citations and 15 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 727 days | 2023-12-05 to 2026-11-12 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 5 days | 2026-11-06 to 2026-11-12 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-11-03 |
| Reported exploitation | ivanti.com | /resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3 | 2022-10-21 |
| Reported exploitation | imperva.com | /blog/new-sysrv-botnet-variant-makes-use-of-google-subdomain-to-spread-xmrig-miner | 2024-03-20 |
| Reported exploitation | go.catonetworks.com | /rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf | 2024-11-20 |
| Reported exploitation | ti.qianxin.com | /blog/articles/operation-run-the-cyber-carnival-of-offshore-patriots-en | 2025-05-19 |
| Exploit reference | VulnCheck XDB 4629537f1e9a | Exploit type: initial-access | 2017-09-06 |
| Exploit reference | VulnCheck XDB bd12f850ebbe | Exploit type: initial-access | 2017-09-10 |
| Exploit reference | VulnCheck XDB 6300c647a9ba | Exploit type: initial-access | 2017-11-24 |
| Exploit reference | VulnCheck XDB 5d8bf4c938d9 | Exploit type: initial-access | 2017-12-04 |
| Exploit reference | VulnCheck XDB 0ea476fd1c98 | Exploit type: infoleak | 2019-08-31 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | An exploit for Apache Struts CVE-2017-9805 | 247 | 2017-09-09 |
| Nuclei | Apache Struts2 S2-052 - Remote Code Execution | ||
| Exploit-DB | Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution | 2017-09-06 | |
| Metasploit | Apache Struts 2 REST Plugin XStream RCE (excellent rank) | ||
| GitHub PoC | CVE 2017-9805 | 60 | 2017-09-06 |
| GitHub PoC | Better Exploit Code For CVE 2017 9805 apache struts | 21 | 2017-12-04 |
| GitHub PoC | Exploit script for Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805) | 15 | 2017-11-24 |
| GitHub PoC | An exploit for Apache Struts CVE-2017-9805 | 5 | 2017-09-10 |
| GitHub PoC | CVE-2017-9805 POC | 3 | 2022-10-03 |
| GitHub PoC | cve -2017-9805 | 3 | 2017-09-07 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Exploitation forks a process. Blocked by the Process rule in PROTECT mode.
Only stops attacks that start a program; an expression that reads files or data directly in Java is not stopped.
The Marshal rule does not apply: it does not hook XStream.
How to mitigate CVE-2017-9805
Upgrade Apache Struts to a release that fixes it: 2.3.34 or 2.5.13. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
8.1 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.struts:struts2-rest-plugin |
2.1.1 | 2.3.34 |
unbounded |
org.apache.struts:struts2-rest-plugin |
2.5.0 | 2.5.13 |
unbounded |
Products and versions
8 products, 14 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | struts | generic | ≥ 2.1.2 and ＜ 2.3.34 · ≥ 2.5.0 and ＜ 2.5.13 |
| nvd | cisco | digital media manager | generic | any version |
| nvd | cisco | hosted collaboration solution | generic | 10.5\(1\) · 11.0\(1\) · 11.5\(1\) · 11.6\(1\) |
| nvd | cisco | media experience engine | generic | 3.5 · 3.5.2 |
| nvd | cisco | network performance analysis | generic | any version |
| nvd | cisco | video distribution suite for internet streaming | generic | any version |
| nvd | netapp | oncommand balance | generic | any version |
| osv | org.apache.struts | struts2-rest-plugin | generic | ≥ 2.1.1 and ＜ 2.3.34 · ≥ 2.5.0 and ＜ 2.5.13 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, REST PLUGIN, NO AUTH REMOTE EXPLOIT **Products:** STRUTS, APACHE STRUTS 2
References
Timeline
Timeline
| Published | 2017-09-15 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2021-11-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2021-11-03 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |