Join our Newsletter — 33% off our NHI Course

CVE-2017-5638 (Apache Struts Remote Code Execution)

CVE-2017-5638 is a remote code execution vulnerability in Apache Struts. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

What This Vulnerability Means in Practice

CVE-2017-5638 is dangerous because it turns a routine request-handling path into code execution. In Apache Struts, the Jakarta Multipart parser can be driven through a crafted Content-Type value, so the weakness sits in the application layer and can be reached without needing a deep foothold first.

The practical consequence is that an attacker who can reach the vulnerable Struts endpoint may be able to execute commands with the application’s privileges. That makes it a classic internet-facing web application risk, especially where the application sits behind business logic, authentication, or internal trust assumptions that do not stop the exploit itself.

How Organisations Assess Exposure

Exposure assessment starts with knowing where Apache Struts is actually deployed, not just where it is documented. Security teams should check asset inventories, software composition data, build manifests, container images, and any externally reachable applications that might still contain the affected component.

Because this is an exploited CVE, the most reliable triage path is to compare your environment against the vendor advisory and the NIST National Vulnerability Database entry, then confirm whether any public-facing Struts applications are present. Where ownership is unclear, verify with application teams rather than assuming the framework is absent.

For organisations building a broader vulnerability program, the Vulnerability Management Guide is useful for understanding how KEV-listed issues should be prioritised, verified, and tracked through remediation.

Remediation and Compensating Controls

The preferred response is to remove the vulnerable condition by applying the vendor’s fixed release path, but that is not always immediate in production. Until the issue is resolved, organisations should reduce exposure by limiting access to the affected application, tightening edge controls, and watching for unusual upload or request patterns that reach the Struts entry point.

Compensating controls matter most where patching is delayed because of change windows, legacy dependencies, or fragile application stacks. In those cases, restricting internet exposure and reducing the number of reachable attack paths can materially lower the chance that a malicious request ever reaches the vulnerable parser.

Broader control catalogues still help frame the response. The NIST SP 800-53 Rev 5 Security and Privacy Controls catalogue is relevant where teams need to anchor patch governance, boundary protection, monitoring, and vulnerability remediation in formal control language.

Detection, Incident Review, and Identity Impact

Detection should focus on evidence that the application was accessed in a way consistent with exploit delivery or post-exploitation activity. That includes unusual multipart requests, unexpected child processes, web shell artefacts, anomalous outbound connections, and changes to the application host that do not fit normal Struts behaviour.

After patching, teams should still review the host and application for signs of compromise before declaring the issue closed. If exploitation is confirmed or strongly suspected, credentials, API keys, session material, service accounts, and any other secrets reachable from the application process should be treated as potentially exposed.

The attack pattern also maps cleanly to the MITRE ATT&CK Enterprise Matrix, which is useful for organizing detection logic around initial access, command execution, and post-compromise follow-on activity.

Risk and Threat Considerations

This vulnerability is materially risky because remote code execution on a web-facing framework can become full application compromise very quickly. Once the attacker can run code, the main question is no longer whether the entry point was reached, but what data, credentials, and internal systems the application can touch next.

Failure mechanism: A crafted Content-Type value reaches the Jakarta Multipart parser, triggers unsafe processing, and gives the attacker a path to execute code through the web application.

Impact: The attacker may gain control of the application process, steal secrets, pivot to connected systems, alter data, or establish persistence through web-accessible tooling or backdoor artefacts.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST CSF 2.0 ID.RA-01 — Asset vulnerabilities are identified and recorded This CVE requires identifying where vulnerable Struts instances exist.
PR.PS-01 — Configuration management is performed Mitigation depends on removing or hardening the vulnerable application state.
DE.CM-01 — Networks and network services are monitored to find events Detection relies on monitoring for exploit delivery and anomalous follow-on activity.
Recommendation — Inventory exposed Struts assets and record the vulnerable application in risk tracking. Apply secure configuration and version control to eliminate the vulnerable Struts condition. Monitor web traffic and host activity for exploit patterns and post-exploitation behaviour.
NIST SP 800-53 Rev 5 RA-5 — Vulnerability Monitoring and Scanning The term is an exploited vulnerability requiring discovery and tracking.
SI-2 — Flaw Remediation The primary control need is timely patching and remediation of the flaw.
AU-6 — Audit Record Review, Analysis, and Reporting Post-exploitation review depends on analysing logs and audit evidence.
Recommendation — Scan for vulnerable Struts deployments and track remediation to closure. Remediate the Struts flaw promptly and verify the fix in production systems. Review logs for exploit traces, web shells, and unusual execution after patching.
OWASP ASVS V16 — Security Logging and Error Handling Detecting exploitation depends on logging and reviewing abnormal request handling.
Recommendation — Ensure request logging and error handling preserve evidence of exploit attempts.
CIS Controls v8 CIS-7 — Continuous Vulnerability Management The vulnerability is an example of a flaw that must be discovered and remediated quickly.
Recommendation — Continuously identify and remediate exposed Struts instances before attackers exploit them.
MITRE ATT&CK T1190 — Exploit Public-Facing Application This CVE is a public-facing application exploit leading to code execution.
Recommendation — Map detections and response actions to public-facing application exploitation techniques.

Practitioner Guidance

Why practitioners should care: Treat KEV-listed remote code execution issues as urgent exposure problems, not routine backlog items. For this class of vulnerability, the operational question is whether the affected application is still reachable, still trusted, and still able to expose downstream assets if compromised.

Practitioner takeaway: Prioritise inventory accuracy, internet exposure reduction, and post-patch compromise review together, because patching alone does not prove the application was never abused.