CVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability
- Published
- Sep 15, 2017
- Updated
- Oct 21, 2025
- Assigning CNA
- apache
- Evidence observed
- Sep 6, 2017
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Sources
http/cves/2017/CVE-2017-9805.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- Vulhub vulnerability labs
Declared conditions
- lab image version: vulhub/struts2:2.5.12-rest-showcase(struts2/s2-052/docker-compose.yml:services.struts2.image)
modules/exploits/multi/http/struts2_rest_xstream.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Python,Unix,Windows($.exploit_multi/http/struts2_rest_xstream.platform)
- verification: check_declared($.exploit_multi/http/struts2_rest_xstream.check)
- -CVE-2017-9805Exploit
Exploit script for Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805)
CVE-2017-9805 S2-052 PoC
- CVE-2017-9805---Documentation---IT19143378Informational
Documentation and analysis of CVE-2017-9805, providing technical details and context for understanding this vulnerability.
- S2-052Exploit
CVE-2017-9805 - Exploit
- cve-2017-9805.pyExploit
Better Exploit Code For CVE 2017 9805 apache struts
- -CVE-2017-9805-Exploit
Python exploit script for Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805) enabling remote command execution and reverse shell on vulnerable Struts2 systems.
An exploit for Apache Struts CVE-2017-9805
- struts-rce-cve-2017-9805Exploit
Go-based remote code execution tool targeting Apache Struts CVE-2017-9805 with single-target and batch-file scanning modes for automated exploitation.
- struts-pwn_CVE-2017-9805Exploit
An exploit for Apache Struts CVE-2017-9805
Proof-of-Concept exploit for Apache Struts S2-052 (CVE-2017-9805) XML Deserialization Remote Code Execution. Created while solving the INE eWPTX Practice Range lab. Includes custom payloads, reverse shell exploit script, and step-by-step exploitation examples.
Ruby-based proof-of-concept exploit for Apache Struts2 REST Plugin XStream RCE (CVE-2017-9805) enabling remote command execution on vulnerable targets.
- Apache-Struts-v4Exploit
Exploit script targeting 5 Apache Struts RCE vulnerabilities (CVE-2013-2251, CVE-2017-5638, CVE-2017-9805, CVE-2018-11776, CVE-2019-0230) with PHP shell payload generation.
- exphubExploit
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
- CVE-2017-9805-ExploitExploit
CVE-2017-9805-Exploit
CVE-2017-9805: Apache Struts 2 S2-052 RCE Exploit - PoC for Harvard University (OTD)
Example web application that run on struts2 REST plugin 2.5.8, for demonstration purpose only
- apache-struts-cve-2017-9805Exploit
Exploit for Apache Struts CVE-2017-9805, a remote code execution vulnerability in the REST plugin. Enables penetration testing and security assessment of Struts-based Java web applications.
CVE-2017-9805 POC
A script to Fuzz and and exploit Apache struts CVE-2017-9805
Simple python script to fuzz site for CVE-2017-9805
- CVE-2017-9805-ExploitExploit
Struts 2.5 - 2.5.12 REST Plugin XStream RCE
- CVE-2017-9805Exploit
struts2-rest-showcase 2.5.10
Warflop · linux · Sep 6, 2017
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.