CVE-2017-9805

What it actually does

The REST Plugin deserializes untrusted XML payloads using XStream without type filtering, permitting instantiation of arbitrary classes and invocation of methods that result in remote code execution.

Why it matters to the business

Attackers can gain complete control of affected web servers, enabling data theft, service disruption, and lateral movement; the vulnerability is listed in CISA KEV with a past remediation deadline and remains actively exploited in the wild.

How an attack unfolds

An attacker identifies a Struts REST endpoint, crafts a malicious XML payload that leverages XStream to instantiate dangerous classes such as those enabling command execution, and submits it via HTTP, resulting in arbitrary code running on the server.

How to fix it

Upgrade apache/struts to the fixed commit 9f5082615ede714618c8694c418210d43338daf6 or later (Struts 2.3.34 or 2.5.13 and newer); disable the REST plugin if unused; apply web-application firewall rules that block suspicious XML payloads.

How to confirm the fix worked

Verify the deployed Struts JAR version against the fixed commit or release notes; retest endpoints with benign XML to confirm deserialization no longer permits arbitrary class instantiation.

Typical attack path

1. Scan for publicly reachable Apache Struts applications exposing REST endpoints
2. Send crafted XML content in a POST or PUT request to trigger XStream deserialization
3. Instantiate classes that execute operating-system commands or establish reverse shells
4. Establish persistence or exfiltrate data from the compromised host

How to detect it

Review web-server access logs for POST/PUT requests containing XML to REST paths; inspect application logs for XStream deserialization warnings or errors; correlate with unexpected child processes such as cmd.exe or /bin/sh spawned by the application user.

• XStreamHandler
• com.thoughtworks.xstream.XStream
• java.lang.ProcessBuilder
• struts2-rest

What your security team should do

• Prioritize upgrade of all Struts instances to patched versions due to KEV status and active exploitation
• Hunt for historical exploitation in web logs and process-creation events
• Implement egress filtering and application allow-listing to limit post-exploitation impact