cve/cves/2017/CVE-2017-9805.md

### [CVE-2017-9805](https://www.cve.org/CVERecord?id=CVE-2017-9805)
![](https://img.shields.io/static/v1?label=Vendor&message=Apache%20Software%20Foundation&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20Struts&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Apache%20Struts%20before%202.3.34%20and%202.5.x%20before%202.5.13&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=RCE&color=brightgreen)
![](https://img.shields.io/static/v1?label=CISA%20KEV&message=Known%20Exploited&color=red)

### Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

### POC

#### Reference
- https://www.exploit-db.com/exploits/42627/

#### Github
- https://github.com/0x00-0x00/-CVE-2017-9805
- https://github.com/0xd3vil/CVE-2017-9805-Exploit
- https://github.com/AvishkaSenadheera/CVE-2017-9805---Documentation---IT19143378
- https://github.com/BeyondCy/S2-052
- https://github.com/Lone-Ranger/apache-struts-pwn_CVE-2017-9805
- https://github.com/RayScri/Struts2-052-POC
- https://github.com/SavoBit/apache-exploit-demo
- https://github.com/Shakun8/CVE-2017-9805
- https://github.com/UbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit
- https://github.com/UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-
- https://github.com/Vancir/s2-052-reproducing
- https://github.com/chrisjd20/cve-2017-9805.py
- https://github.com/hahwul/struts2-rce-cve-2017-9805-ruby
- https://github.com/jongmartinez/-CVE-2017-9805-
- https://github.com/luc10/struts-rce-cve-2017-9805
- https://github.com/mazen160/struts-pwn_CVE-2017-9805
- https://github.com/rvermeulen/apache-struts-cve-2017-9805
- https://github.com/samqbush/struts-rest-showcase
- https://github.com/sujithvaddi/apache_struts_cve_2017_9805
- https://github.com/wifido/CVE-2017-9805-Exploit
- https://github.com/z3bd/CVE-2017-9805
- https://github.com/7s26simon/CVE-2017-9805-S2-052
- https://github.com/Fl5xia/CVE-2017-9805
- https://github.com/NoSpaceAvailable/CVE-2017-9805_example_build
- https://github.com/agent3137/CVE-2017-9805-Exploit
- https://github.com/Experience-rookie/struts-s2-052-deserialization-rce-lab

#### Nuclei
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9805.yaml

#### ExploitDB
- https://www.exploit-db.com/exploits/42627

#### Metasploit
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/struts2_rest_xstream.rb