Patchfirst
Patchfirst
CVE-2024-53677 Public exploit Critical · 9.5 EPSS 72.4%

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

Apache Software Foundation · Apache Struts

Summary

The flaw is in the file upload logic of Apache Struts, the Apache Software Foundation's web application framework, where mixing setters for uploaded files and normal form fields allows file upload checks to be bypassed. An attacker who can manipulate the file upload parameters over the network, without authentication or user interaction, can use path traversal to place a malicious file and, under some circumstances, achieve remote code execution; this applies to Struts 2.0.0 before 6.4.0 when the older FileUploadInterceptor-based upload mechanism is in use.

Official description · CVE.org

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

Breakdown
69.2 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 4 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+1 day
  3. First seen exploitedVulnCheck KEV evidence+4 days

6 fixes in struts2-core over 2 years. The latest fix listed for struts2-core is 7.1.1.

Fixes in struts2-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 6.1.2.1CVE-2023-3439614 Jun 2023
  2. 6.3.0.1CVE-2023-418355 Dec 2023
  3. 6.3.0.2CVE-2023-501647 Dec 2023
  4. 6.4.0CVE-2024-5367711 Dec 2024
  5. 7.1.1CVE-2025-647751 Dec 2025
  6. 7.1.1CVE-2025-6667510 Dec 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.struts:struts2-core.

Mavenorg.apache.struts:struts2-coreGHSA-43mq-6xmg-29vm

Upgrade to 6.4.0 or later

Fixes this CVE and 25 other known vulnerabilities in this package (CVE-2008-6505, CVE-2010-1870, +23).

Set the version to 6.4.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2024-53677.

Affected versions

If you runUpgrade to
All versions before 6.4.06.4.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 14 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

vendor-advisory 1

cwiki.apache.org/confluence/display/WW/S2-067

Other 1

security.netapp.com/advisory/ntap-20250103-0005/
↑ ↓ chooseEnter openEsc close