# MA-682.092017: MyCERT Advisory - Apache Software Foundation Releases Security Update

**Date:** 19 Sep 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-682.092017  
**Advisory ID:** MA-682.092017

---

**1.0    Introduction**
The Apache Software Foundation has released a security update to address multiple vulnerabilities in Apache Struts 2.
**2.0    CVE Number**
Attach the CVE numbers of the vulnerabilities for detailed information.
|  |
| --- | --- | --- | **No** | **CVE Number** | **Description** | **1.** | CVE-2017-5638 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles file upload, which allows remote attackers to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header, as exploited in the wild in March 2017. | **2.** | CVE-2017-7672 | If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12. | **3.** | CVE-2017-9787 | When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33. | **4.** | CVE-2017-9791 | The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. | **5.** | CVE-2017-9805 | The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. |
**3.0    Impact**
A remote attacker could exploit this vulnerability to take control of an affected system.
**4.0    Affected Products**
•    Struts 2.1.2 - Struts 2.3.33
•    Struts 2.5 - Struts 2.5.12
**4.0 Recommendation**
a.    Apply an Update:
The vendor has released version 2.5.13 and 2.3.34 to address these vulnerabilities.
Or the below workaround;
b.    Remove or limit the REST plugin
If it is not used, consider removing the REST plugin. Per the vendor, it is also possible to limit its functionality to normal server pages or JSON with the following configuration change in struts.xml:
| --- | <constant name="struts.action.extension" value="xhtml,,json" /> |
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor, apply necessary updates and follow best practice security policies.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#482b312a2d3a717171082b312a2d3a3b2d2b3d3a213c31662531) or [[email protected]](/cdn-cgi/l/email-protection#4a2733292f383e0a2733292f383e6425382d642733)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
•    <https://www.us-cert.gov/ncas/current-activity/2017/09/06/Apache-Software-Foundation-Releases-Security-Update>
•    <https://cwiki.apache.org/confluence/display/WW/S2-052>
•    <https://www.kb.cert.org/vuls/id/112992>