Critical Remote Code Execution in Apache Struts REST Plugin (CVE‑2017‑9805)
What It Is — Apache Struts 2’s REST plugin employs an XStreamHandler that deserializes XML payloads without type filtering. This flaw enables an unauthenticated attacker to execute arbitrary code on the vulnerable server.
Exploitability — Public exploits and proof‑of‑concept code have been circulating since 2017; the vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
Affected Products — Apache Struts 2 (all versions prior to the 2.5.13 patch) that use the REST plugin with the default XStreamHandler configuration.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous inventory and monitoring of third‑party components to prove due‑diligence.
- Highlights a control gap in secure configuration management; evidence of remediation (patch status, runtime checks) is essential for audit readiness.
- Affected organizations must be able to produce defensible evidence that vulnerable libraries have been identified, patched, or mitigated, a core expectation of enterprise buyers.
Recommended Actions
- Identify all applications using Apache Struts 2 REST plugin and verify the version.
- Apply the Apache‑released patch (Struts 2.5.13 or later) or implement a runtime block on the vulnerable XStream deserialization path.
- Integrate automated component scanning into your CI/CD pipeline to generate continuous evidence of library compliance.
- Document remediation steps in your control evidence repository for audit purposes.
Source: CISA KEV – CVE‑2017‑9805