Apache Struts framework has been detected with a critical vulnerability that could allow attackers to execute malicious code remotely, posing a significant risk to affected systems.
The vulnerability tracked as CVE-2024-53677, with a CVSS score of 9.5. rooted in the file upload logic, which affects Apache Struts versions from 2.0.0 up to but not including 6.4.0. Attackers can exploit this flaw by manipulating file upload parameters, enabling path traversal, and potentially allowing the upload and execution of malicious files on the server.
Given the high impact on system confidentiality, integrity, and availability, this vulnerability is particularly dangerous as it can be exploited without requiring any elevated privileges.
To mitigate this critical risk, developers are advised to upgrade to Apache Struts version 6.4.0 or higher, which includes necessary patches and fixes. Additionally, users should switch to the Action File Upload Interceptor, replacing the deprecated File Upload Interceptor as of version 6.4.0. Continuing to use the old interceptor keeps systems vulnerable to this serious security threat.
It is crucial for developers to promptly apply the necessary updates to protect their systems from potential exploitation. Regularly updating and reviewing security configurations can significantly reduce the risk of such vulnerabilities.
