Path traversal in Apache Struts - CVE-2024-53677
Published: December 11, 2024 / Updated: February 25, 2025
Vulnerability identifier: #VU101653
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-53677
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in filenames during file upload within Action File Upload Interceptor. A remote attacker can upload a specially crafted file to the server into an arbitrary directory.
Successful exploitation may allow an attacker to upload an arbitrary file and execute it on the server, leading to a full system compromise.
Affected software
Apache Struts
Oracle Communications Policy Management
Library Support for Struts
Guardium Data Protection
Juniper Secure Analytics (JSA)
Oracle Communications Policy Management
Library Support for Struts
Guardium Data Protection
Juniper Secure Analytics (JSA)
How to mitigate CVE-2024-53677
Install update from vendor's website.
Apache Struts - update to 6.4.0
Library Support for Struts - update to 2.5.37
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
Guardium Data Protection - update to 11.0p494
Library Support for Struts - update to 2.5.37
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
Guardium Data Protection - update to 11.0p494
Links to Public Exploits and PoC-codes
- Exploit #11178 - CVE-2024-53677-Exploit (February 25, 2025)
- Exploit #11152 - CVE-2024-53677 (February 21, 2025)
- Exploit #11059 - CVE-2024-53677 (January 10, 2025)
- Exploit #11030 - CVE-2024-53677-S2-067-thread (December 27, 2024)
- Exploit #11002 - CVE-2024-53677 (December 19, 2024)
- Exploit #10999 - CVE-2024-53677-S2-067 (December 19, 2024)
- Exploit #10997 - CVE-2024-53677-Docker (December 19, 2024)