Apache Struts 2 REST Plugin XML Deserialization Remote Code Execution Vulnerability (CVE-2017-9805, S2-052)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Struts versions 2.1.1 through 2.3.33 and 2.5 through 2.5.12 using the REST plugin
Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending malicious XML payloads
Immediately upgrade Apache Struts to version 2.3.34 or 2.5.13 or higher, or restrict/disable XML handling in the REST plugin
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache Struts to version 2.3.34 or 2.5.13 or higher. Update your Maven pom.xml configuration as follows:
<!-- Upgrade Struts 2 dependencies in pom.xml -->
<dependency>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-core</artifactId>
<version>2.5.13</version>
</dependency>
<dependency>
<groupId>org.apache.struts</groupId>
<artifactId>struts2-rest-plugin</artifactId>
<version>2.5.13</version>
</dependency>2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, you can mitigate the risk by limiting the accepted content types in the REST plugin configuration to exclude XML, or by removing the REST plugin JAR if it is not required.
<!-- Modify struts.xml to restrict allowed extensions and disable XML handler -->
<constant name='struts.action.extension' value='xhtml,json' />3. Log Audit & IoC Verification Commands
Use the following command to scan web server access logs or application logs for signatures of XStream deserialization exploitation attempts:
# Scan logs for common XStream RCE gadget indicators
grep -riE '(java\.beans\.ProcessBuilder|command|imageio)' /var/log/nginx/ /var/log/apache2/ /usr/local/tomcat/logs/Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (S2-052) exists in the REST plugin of Apache Struts 2 due to unsafe deserialization of XML payloads. The REST plugin utilizes the XStream library (via XStreamHandler) to deserialize incoming HTTP requests into Java objects based on the Content-Type header. However, the XStreamHandler performs this deserialization without any type filtering or validation, allowing arbitrary Java object graphs to be instantiated in memory, leading to Remote Code Execution (RCE).
2. Exploitation Mechanics & Attack Scenario
An attacker sends an HTTP POST or PUT request with the Content-Type header set to 'application/xml'. The request body contains a crafted XML payload representing serialized Java objects. By leveraging common gadget chains (such as 'java.beans.ProcessBuilder' or 'javax.imageio.ImageIO'), the attacker forces the application to execute arbitrary OS commands during the deserialization process. Since this occurs before any authentication or authorization checks, it can be executed by any remote user with network access to the endpoint.
3. Infrastructure & Business Impact
With a CVSS score of 8.1 and an EPSS score of over 0.994, this vulnerability is highly critical and has been actively exploited in the wild (listed in CISA KEV). Successful exploitation grants the attacker full control over the application server under the privileges of the web server process. This can lead to lateral movement within the internal network, data exfiltration, deployment of ransomware, or complete system compromise.
Official Vendor Advisories & References
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Frequently Asked SecOps Questions (CVE-2017-9805)
FAQQ1. How critical is CVE-2017-9805 and is it actively exploited in the wild?
CVE-2017-9805 is rated CVSS 8.1 (HIGH) with a 30-day EPSS exploitation probability of 99.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-9805?
Primary impacted vendors include apache across struts. Scope summary: Apache Struts 2.1.1 through 2.3.33 and 2.5 through 2.5.12 (when using the REST plugin)
Q3. What temporary mitigations or workarounds exist for CVE-2017-9805 before patching?
[Mitigation] Immediately upgrade Apache Struts to version 2.3.34 or 2.5.13 or higher, or restrict/disable XML handling in the REST plugin Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-9805
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.