CVE-2024-53677:
Apache Struts file upload logic is flawed
N/A
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
12/11/2024
Updated
1/3/2025
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 6.4.0 | 6.4.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from the legacy FileUploadInterceptor and its associated multipart request handling. The advisory explicitly states that applications using FileUploadInterceptor are vulnerable, while the newer ActionFileUploadInterceptor (introduced in 6.4.0) is safe. The FileUploadInterceptor's intercept method is responsible for processing upload parameters, and the JakartaMultiPartRequest's parse method handles raw file upload data. Both fail to adequately sanitize user-supplied filenames, allowing path traversal. Confidence is high for FileUploadInterceptor due to direct advisory references, and medium for JakartaMultiPartRequest due to its role in the deprecated upload mechanism.
Vulnerable functions
org.apache.struts2.interceptor.FileUploadInterceptor.interceptorg/apache/struts2/interceptor/FileUploadInterceptor.java
The FileUploadInterceptor handles file upload parameters without properly sanitizing filenames, allowing attackers to inject path traversal sequences (e.g., '../') in filename parameters. This enables malicious files to be written to unintended locations, leading to potential RCE.
org.apache.struts2.dispatcher.multipart.JakartaMultiPartRequest.parseorg/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java
This method processes multipart requests and constructs file paths using user-controlled filenames. Lack of proper validation against path traversal sequences in the filename parameter makes it vulnerable to directory traversal attacks.