Apache Struts up to 2.5.32/6.3.0.1 File Upload file access

Summaryinfo

A vulnerability identified as problematic has been detected in Apache Struts up to 2.5.32/6.3.0.1. Affected by this vulnerability is an unknown functionality of the component File Upload Handler. Performing a manipulation results in file access. This vulnerability is reported as CVE-2023-50164. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Struts up to 2.5.32/6.3.0.1 (Programming Tool Software). It has been classified as critical. This affects some unknown functionality of the component File Upload Handler. The manipulation with an unknown input leads to a file access vulnerability. CWE is classifying the issue as CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or  Struts 6.3.0.1 or greater to fix this issue.

The weakness was disclosed 12/07/2023. The advisory is shared at lists.apache.org. This vulnerability is uniquely identified as CVE-2023-50164 since 12/04/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/14/2025). MITRE ATT&CK project uses the attack technique T1083 for this issue.

Upgrading to version 2.5.33 or 6.3.0.2 eliminates this vulnerability. The upgrade is hosted for download at cwiki.apache.org.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Tool Software

Vendor

• Apache

Name

• Struts

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 6.3.0.0
• 6.3.0.1

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion