CVE-2017-5638
Apache Struts Remote Code Execution Vulnerability
- Published
- Mar 11, 2017
- Updated
- Oct 21, 2025
- Assigning CNA
- apache
- Evidence observed
- Mar 7, 2017
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Sources
http/cves/2017/CVE-2017-5638.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex,status($.matchers[*].type)
struts2/s2-045
S2-045 Remote Code Execution Vulnerablity（CVE-2017-5638）
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/struts2:2.3.30(struts2/s2-045/docker-compose.yml:services.struts2.image)
struts2/s2-046
S2-046 Remote Code Execution Vulnerablity（CVE-2017-5638）
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/struts2:2.3.30(struts2/s2-046/docker-compose.yml:services.struts2.image)
modules/exploits/multi/http/struts2_content_type_ognl.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix,Windows($.exploit_multi/http/struts2_content_type_ognl.platform)
- verification: check_declared($.exploit_multi/http/struts2_content_type_ognl.check)
- CVE-2017-5638Exploit
Struts02 s2-045 exploit program
- Struts2-045-ExpExploit
CVE-2017-5638
- CVE-2017-5638-Attack-and-DefenseResearch
Docker-based security lab demonstrating Apache Struts2 S2-045 (CVE-2017-5638) exploitation and defense, featuring vulnerable and patched applications with WAF protection for hands-on training.
- Apache-StrutsExploit
Python-based exploit for Apache Struts CVE-2017-5638 with single URL and batch scanning modes, vulnerability checking, and Nmap reconnaissance integration.
Python proof-of-concept exploit for Apache Struts2 RCE vulnerability CVE-2017-5638, demonstrating remote code execution via crafted Content-Type header.
Proof-of-concept exploit for Apache Struts2 remote code execution vulnerability CVE-2017-5638, enabling unauthenticated attackers to execute arbitrary commands via crafted Content-Type headers.
- Common-Vulnerability-and-ExploitResearch
This is the Apache Struts CVE-2017-5638 struts 2 vulnerability. The same CVE that resulted in the equifax database breach.
Hands-on lab demonstrating Apache Struts2 OGNL injection (CVE-2017-5638) with step-by-step system analysis, exploitation, sandbox bypass, and post-exploitation techniques for penetration testing education.
- StrutsShellExploit
Interactive command-line shell for exploiting Apache Struts CVE-2017-5638. Automates HTTP/HTTPS exploitation with real-time shell interaction on vulnerable targets.
A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10
- struts2-jakarta-injectExploit
Golang exploit for CVE-2017-5638
- struts2-toolExploit
Struts2 S2-045/S2-046 CVE-2017-5638 detection & exploitation tool
Apache Struts2 CVE-2017-5638 (Safe Educational Demo)
- struts2-rcePoC
Exploitable target to CVE-2017-5638
PoC for CVE: 2017-5638 - Apache Struts2 S2-045
- Struts2ShellExploit
An exploit (and library) for CVE-2017-5638 - Apache Struts2 S2-045 bug.
- cve-2017-5638Exploit
Docker-based vulnerable environment and Python exploit script demonstrating CVE-2017-5638 (Apache Struts2 RCE) for educational security testing.
- CVE-2017-5638Scanner
Multithreaded vulnerability validator for Apache Struts 2 (CVE-2017-5638) that scans thousands of endpoints via HTTP header injection to detect Struts-Shock without malicious payloads.
This repository provides a PoC for CVE-2017-5638, a remote code execution vulnerability in Apache Struts 2, exploitable via a crafted Content-Type HTTP header.
- XworkStruts-RCEExploit
(CVE-2017-5638) XworkStruts RCE Vuln test script
- struts2_cve-2017-5638Exploit
Java-based exploit for Apache Struts2 CVE-2017-5638, executing arbitrary commands via crafted HTTP headers. Intended for authorized security assessments.
- struts-pwnExploit
An exploit for Apache Struts CVE-2017-5638
- Struts2VulnPoC
Struts 2 web app that is vulnerable to CVE-2017-98505 and CVE-2017-5638
- CVE-2017-5638Exploit
An exploit for CVE-2017-5638
- CVE-2017-5638-Apache-Struts2Exploit
Example PHP Exploiter for CVE-2017-5638
- CVE-2017-5638Exploit
Apache Struts 2.0 RCE vulnerability - Allows an attacker to inject OS commands into a web application through the content-type header
- S2-045Research
Struts2 S2-045（CVE-2017-5638）Vulnerability environment - http://www.mottoin.com/97954.html
- CVE-2017-5638Exploit
Python-based proof-of-concept exploit for CVE-2017-5638, a remote code execution vulnerability in Apache Struts 2, enabling command injection against vulnerable targets.
- CVE-2017-5638Exploit
CVE: 2017-5638 in different formats
- CVE-2017-5638Exploit
This script is intended to validate Apache Struts 2 vulnerability (CVE-2017-5638), AKA Struts-Shock.
- struts-rce-cve-2017-5638Exploit
Struts-RCE CVE-2017-5638
- StutsfiExploit
An exploit for CVE-2017-5638 Remote Code Execution (RCE) Vulnerability in Apache Struts 2
Automated remote code execution exploit for Apache Struts2 (CVE-2017-5638) with auto-exploitation capabilities for penetration testing and vulnerability verification.
Mass scanner for Apache Struts CVE-2017-5638 remote code execution vulnerability. Automates detection and exploitation of vulnerable Struts endpoints across multiple targets.
- CVE-2017-5638Informational
Educational analysis of Apache Struts 2 RCE vulnerability CVE-2017-5638, including exploit details, Equifax case study, and prevention measures.
Build the struts-2.3.31 (CVE-2017-5638) environment
- CVE-2017-5638Exploit
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution - Shell Script
Proof of concept of CVE-2017-5638 including the whole setup of the Apache vulnerable server
- CVE-2017-5638Exploit
Proof-of-concept exploit for Apache Struts vulnerability CVE-2017-5638, with scripts to scan random IPs, check for the vulnerability, and execute commands on unpatched servers.
- Struts2-045-ExpExploit
Struts2 S2-045（CVE-2017-5638）Exp with GUI
- CVE-2017-5638Exploit
CVE-2017-5638 Exploit Rewritten In Python By haxerr9
- st2-046-pocPoC
st2-046-poc CVE-2017-5638
- struts_hackExploit
Exploit tool for Apache Struts CVE-2017-5638, using OGNL injection to gain remote access to vulnerable servers via command-line interface.
Exploit created by: R4v3nBl4ck end Pacman
- Apache-Struts-v4Exploit
Exploit script targeting 5 Apache Struts RCE vulnerabilities (CVE-2013-2251, CVE-2017-5638, CVE-2017-9805, CVE-2018-11776, CVE-2019-0230) with PHP shell payload generation.
Example PoC Code for CVE-2017-5638 | Apache Struts Exploit
- exphubExploit
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
Tweaking original PoC (https://github.com/rapid7/metasploit-framework/issues/8064) to work on self-signed certificates
- CVE-2017-5638Exploit
Python3 exploit for Apache Struts2 remote code execution vulnerability CVE-2017-5638, enabling command execution on vulnerable servers.
Proof-of-concept exploit for Apache Struts2 remote code execution vulnerability CVE-2017-5638, demonstrating exploitation via crafted Content-Type header.
- strutszeiroExploit
Telegram Bot to manage botnets created with struts vulnerability(CVE-2017-5638)
Docker-based test environment for CVE-2017-5638 (Apache Struts2 remote code execution) with WAR deployment for vulnerability validation and exploitation practice.
- struts-rceExploit
Apache Struts CVE-2017-5638 RCE exploitation
- CVE-2017-5638Exploit
Exploit for Apache Struts2 remote code execution vulnerability (CVE-2017-5638) via Content-Type header manipulation.
- apache-struts2-CVE-2017-5638Exploit
Demo application and exploit for Apache Struts2 CVE-2017-5638, providing a sample vulnerable app and reference exploit for security testing and education.
- cve-2017-5638Exploit
Demo app of THAT data broker's security breach
- strutserScanner
Check for Struts Vulnerability CVE-2017-5638
- S2-045-EXP-POC-TOOLSExploit
Proof-of-concept exploit for Apache Struts2 S2-045 (CVE-2017-5638) remote code execution vulnerability via malicious Content-Type header.
- jexbossExploit
JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool
- S2-046_S2-045_POCExploit
S2-046|S2-045: Struts 2 Remote Code Execution vulnerability（CVE-2017-5638）
A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos
- CVE-2017-5638-Mass-ExploitExploit
- ExpStrutsExploit
A php based exploiter for CVE-2017-5638.
- cve-2017-5638Exploit
Python-based exploit for Apache Struts2 remote code execution vulnerability CVE-2017-5638, enabling targeted security testing and validation of affected systems.
- Exploit-CVE-2017-5638Exploit
this exemple of application permet to test the vunerability CVE_2017-5638
Exploit for CVE-2017-5638, a remote code execution vulnerability in Apache Struts2. Provides payload generation and delivery for penetration testing of Struts2-based web applications.
- web-application-firewall-Exploit
This project demonstrates a Web Application Firewall (WAF) simulation using Flask and a vulnerability checker for CVE-2017-5638. The WAF middleware blocks HTTP requests containing specific patterns, and the vulnerability checker tests for and exploits the Apache Struts 2 vulnerability (CVE-2017-5638).
- StrutscliExploit
Struts2 RCE CVE-2017-5638 CLI shell
- Struts-Apache-ExploitPackExploit
These are just some script which you can use to detect and exploit the Apache Struts Vulnerability (CVE-2017-5638)
Struts2 Application Vulnerable to CVE-2017-5638. Explains how the exploit of the vulnerability works in relation to OGNL and the JakartaMultiPart parser.
test struts2 vulnerability CVE-2017-5638 in Mac OS X
- CVE-2017-5638Exploit
- struts2-rcePoC
Exploitable target to CVE-2017-5638
A practical lab demonstrating the exploitation of a critical Remote Code Execution (RCE) vulnerability in Apache Struts2 (CVE-2017-5638) using Vulhub Docker environments. Includes setup instructions and commands to run the vulnerable container.
- strutsyExploit
Strutsy - Mass exploitation of Apache Struts (CVE-2017-5638) vulnerability
- cve-2017-5638Exploit
- CVE-2017-5638Exploit
Exploit for Apache Struts2 remote code execution vulnerability (CVE-2017-5638) with Google Dork reconnaissance for target discovery.
Vex Woo · linux · Mar 7, 2017
- Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - 'Jakarta' Multipart Parser OGNL Injection (Metasploit)Exploit
Metasploit · multiple · Mar 15, 2017
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.