Apache Struts2 File Upload Remote Code Execution (CVE-2024-53677)

CVE-2024-53677 is a critical file-upload flaw in Apache Struts2 that lets remote attackers upload malicious files and achieve RCE on Linux Tomcat/Jetty hosts running Struts webapps.

Affected Struts

• Apache Struts 2.0.0 through 2.3.37 (EOL branches)
• Apache Struts 2.5.0 through 2.5.33
• Apache Struts 6.0.0 through 6.0.3
• Custom WAR deployments on Tomcat behind nginx

Check if Struts is present

find /var/lib/tomcat* -name 'struts2-core*.jar' 2>/dev/null
grep -R 'struts.actionExtension' /opt/*/WEB-INF/classes/ 2>/dev/null
curl -s http://app:8080/ | grep -i struts

Patching Method

1. Stop the app server (maintenance window): systemctl stop tomcat
2. Upgrade Struts JAR in each WAR to fixed release (2.5.34, 6.0.4, or vendor backport). Replace WEB-INF/lib/struts2-core-*.jar.
3. Rebuild/redeploy WAR or run vendor CI pipeline; do not hot-swap JARs on production without test.
4. Restart and verify: systemctl start tomcat && jar tf app.war | grep struts2-core
5. Post-patch hunt: scan webapps/ for .jsp, .class shells uploaded during exposure.

# Example: verify fixed Struts version in deployed WAR
unzip -p /opt/tomcat/webapps/ROOT.war META-INF/MANIFEST.MF | grep -i struts
find /var/log/tomcat -mtime -7 -name '*.log' | xargs grep -i upload

Hardening after patch

• Block file upload endpoints at WAF until patched
• Run Tomcat as non-root; read-only app base where possible
• Subscribe to Apache Struts security announcements