CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2024-53677

CVSS 9.5v4.0pub. 2024-12-11upd. 2025-07-15

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

An attacker manipulates request parameters related to file upload (file upload params), which allows bypassing destination path restrictions through path traversal. Under favorable circumstances, this enables writing a malicious file to any location on the server. The uploaded file can then be executed by the server, leading to Remote Code Execution. The vulnerability is related to the FileuploadInterceptor mechanism — applications using only the new upload mechanism are not exposed.

Impact

An attacker can gain full control over the server through remote code execution (RCE), which may lead to compromise of confidentiality, integrity, and availability of both the attacked system and resources connected to it.

Mitigation & patch

Apache Struts should be updated to version 6.4.0 or later and migration to the new file upload mechanism described at https://struts.apache.org/core-developers/file-upload should be performed. Applications that do not use FileuploadInterceptor are not vulnerable. Details are described in bulletin S2-067: https://cwiki.apache.org/confluence/display/WW/S2-067

Who is affected

Apache Struts in versions 2.0.0 to 6.3.x (before 6.4.0), using the old file upload mechanism based on FileuploadInterceptor.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red