Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

Bugtraq ID:	99484
Class:	Input Validation Error
CVE:	CVE-2017-9791
Remote:	Yes
Local:	No
Published:	Jul 07 2017 12:00AM
Updated:	Sep 27 2017 03:00PM
Credit:	icez <ic3z at qq dot com> from Tophant Competence Center
Vulnerable:	Oracle Weblogic Server 10.3.6 0 Oracle Weblogic Server 12.2.1.3 Oracle Weblogic Server 12.2.1.2 Oracle Weblogic Server 12.2.1.1 Oracle Weblogic Server 12.2.1.0 Oracle Weblogic Server 12.1.3.0 Oracle Siebel Applications 7.1 Oracle Siebel Applications 6.2 Oracle Siebel Applications 16.1 Oracle MySQL Enterprise Monitor 3.2.1182 Oracle MySQL Enterprise Monitor 3.4.2.4181 Oracle MySQL Enterprise Monitor 3.4.1 Oracle MySQL Enterprise Monitor 3.4.0 Oracle MySQL Enterprise Monitor 3.3.4.3247 Oracle MySQL Enterprise Monitor 3.3.3.1199 Oracle MySQL Enterprise Monitor 3.3.2.1162 Oracle MySQL Enterprise Monitor 3.3.0.1098 Oracle MySQL Enterprise Monitor 3.2.8.2223 Oracle MySQL Enterprise Monitor 3.2.7.1204 Oracle MySQL Enterprise Monitor 3.2.5.1141 Oracle MySQL Enterprise Monitor 3.2.4.1102 Oracle MySQL Enterprise Monitor 3.2.1.1049 Oracle MICROS Retail XBRi Loss Prevention 10.8.1 Oracle MICROS Retail XBRi Loss Prevention 10.8 Oracle MICROS Retail XBRi Loss Prevention 10.7 Oracle MICROS Retail XBRi Loss Prevention 10.6 Oracle MICROS Retail XBRi Loss Prevention 10.5 Oracle MICROS Retail XBRi Loss Prevention 10.0.1 Oracle Insurance Performance Insight for General Insurance 8.0 Oracle Insurance Data Foundation 8.0.5 Oracle Insurance Data Foundation 8.0.4 Oracle Insurance Data Foundation 8.0.3 Oracle Insurance Data Foundation 8.0.2 Oracle Insurance Data Foundation 8.0.1 Oracle FLEXCUBE Private Banking 12.1 Oracle FLEXCUBE Private Banking 12.0.3 Oracle FLEXCUBE Private Banking 12.0.2 Oracle FLEXCUBE Private Banking 12.0.1 Oracle FLEXCUBE Private Banking 12.0 Oracle FLEXCUBE Private Banking 2.2 Oracle FLEXCUBE Private Banking 3.0 Oracle Financial Services Retail Performance Analytics 8.0.5 Oracle Financial Services Retail Performance Analytics 8.0.4 Oracle Financial Services Retail Performance Analytics 8.0.3 Oracle Financial Services Retail Performance Analytics 8.0.2 Oracle Financial Services Retail Performance Analytics 8.0.1 Oracle Financial Services Retail Performance Analytics 8.0 Oracle Financial Services Retail Customer Analytics 8.0.5 Oracle Financial Services Retail Customer Analytics 8.0.4 Oracle Financial Services Retail Customer Analytics 8.0.3 Oracle Financial Services Retail Customer Analytics 8.0.2 Oracle Financial Services Retail Customer Analytics 8.0.1 Oracle Financial Services Retail Customer Analytics 8.0 Oracle Financial Services Profitability Management 8.0.5 Oracle Financial Services Profitability Management 8.0.4 Oracle Financial Services Profitability Management 8.0.3 Oracle Financial Services Profitability Management 8.0.2 Oracle Financial Services Profitability Management 8.0.1 Oracle Financial Services Profitability Management 6.1.1 Oracle Financial Services Profitability Management 6.1 Oracle Financial Services Profitability Management 6.0 Oracle Financial Services Pricing Management 8.0.5 Oracle Financial Services Pricing Management 8.0.4 Oracle Financial Services Pricing Management 8.0 Oracle Financial Services Price Creation and Discovery 8.0.5 Oracle Financial Services Price Creation and Discovery 8.0.4 Oracle Financial Services Price Creation and Discovery 8.0 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.5 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.4 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.3 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.2 Oracle Financial Services Loan Loss Forecasting and Provisioning 8.0.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5.1 Oracle Financial Services Loan Loss Forecasting and Provisioning 1.5 Oracle Financial Services Liquidity Risk Management 8.0.4 Oracle Financial Services Liquidity Risk Management 8.0.2 Oracle Financial Services Liquidity Risk Management 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0.5 Oracle Financial Services Institutional Performance Analytics 8.0.4 Oracle Financial Services Institutional Performance Analytics 8.0.3 Oracle Financial Services Institutional Performance Analytics 8.0.2 Oracle Financial Services Institutional Performance Analytics 8.0.1 Oracle Financial Services Institutional Performance Analytics 8.0 Oracle Financial Services ICAAP Analytics 8.0 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.3 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.2 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.1 Oracle Financial Services Hedge Management and IFRS Valuations 6.1.1 Oracle Financial Services Funds Transfer Pricing 8.0.5 Oracle Financial Services Funds Transfer Pricing 8.0.4 Oracle Financial Services Funds Transfer Pricing 8.0.3 Oracle Financial Services Funds Transfer Pricing 8.0.2 Oracle Financial Services Funds Transfer Pricing 8.0.1 Oracle Financial Services Funds Transfer Pricing 6.1.1 Oracle Financial Services Funds Transfer Pricing 6.1 Oracle Financial Services Funds Transfer Pricing 6.0 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.5 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.4 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.3 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.2 Oracle Financial Services Enterprise Financial Performance Analytics 8.0.1 Oracle Financial Services Enterprise Financial Performance Analytics 8.0 Oracle Financial Services Data Integration Hub 8.0.4 Oracle Financial Services Data Integration Hub 8.0.3 Oracle Financial Services Data Integration Hub 8.0.2 Oracle Financial Services Data Integration Hub 8.0.1 Oracle Financial Services Data Foundation 8.0.5 Oracle Financial Services Data Foundation 8.0.4 Oracle Financial Services Data Foundation 8.0.3 Oracle Financial Services Data Foundation 8.0.2 Oracle Financial Services Data Foundation 8.0.1 Oracle Financial Services Data Foundation 7.4 Oracle Financial Services Data Foundation 7.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.4 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.3 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.2 Oracle Financial Services Basel Regulatory Capital Internal Ratings Bas 8.0.1 Oracle Financial Services Basel Regulatory Capital Basic 8.0.4 Oracle Financial Services Basel Regulatory Capital Basic 8.0.3 Oracle Financial Services Basel Regulatory Capital Basic 8.0.2 Oracle Financial Services Basel Regulatory Capital Basic 8.0.1 Oracle Financial Services Asset Liability Management 8.0.5 Oracle Financial Services Asset Liability Management 8.0.4 Oracle Financial Services Asset Liability Management 8.0.3 Oracle Financial Services Asset Liability Management 8.0.2 Oracle Financial Services Asset Liability Management 8.0.1 Oracle Financial Services Asset Liability Management 6.1.1 Oracle Financial Services Asset Liability Management 6.1 Oracle Financial Services Asset Liability Management 6.0 Oracle Financial Services Analytical Applications Reconciliation 8.0.4 Oracle Financial Services Analytical Applications Reconciliation 8.0.3 Oracle Financial Services Analytical Applications Reconciliation 8.0.2 Oracle Financial Services Analytical Applications Reconciliation 8.0.1 Oracle Financial Services Analytical Applications Reconciliation 8.0 Oracle Financial Services Analytical Applications Reconciliation 3.5.1 Oracle Financial Services Analytical Applications Reconciliation 3.5 Oracle Financial Services Analytical Applications Infrastructure 7.3 Oracle Financial Services Analytical Applications Infrastructure 7.2 Oracle Communications Policy Management 12.1.1 Oracle Communications Policy Management 12.1 Oracle Communications Policy Management 11.5 Oracle Communications Policy Management 12.2 Apache Struts 2.3.31 Apache Struts 2.3.30 Apache Struts 2.3.28 Apache Struts 2.3.24 Apache Struts 2.3.5 Apache Struts 2.3.4 Apache Struts 2.3.8 Apache Struts 2.3.7 Apache Struts 2.3.32 Apache Struts 2.3.29 Apache Struts 2.3.20 Apache Struts 2.3.16 Apache Struts 2.3.15 Apache Struts 2.3.1
Not Vulnerable:

Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

Apache Struts is prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the affected application.

Apache Struts 2.3.x with Struts 1 plugin and Struts 1 action are vulnerable.

Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

References:

• Announcements (Apache)
  
• Apache Homepage (Apache)
  
• Struts Homepage (Apache Software Foundation)
  
• Oracle Security Alert Advisory - CVE-2017-9805 (Oracle)
  
• Possible RCE in the Struts Showcase app in the Struts 1 plugin example in Struts (Apache)