Apache Struts 2 CVE-2017-5638 / S2-045 (Jakarta Multipart parser remote code execution via file upload headers, CISA KEV): which versions are fixed and how to find Struts in my estate?

What it is: CVE-2017-5638 (Apache security bulletin S2-045) is a remote code execution flaw in the Jakarta Multipart parser used for file uploads in Struts 2, caused by faulty error handling that evaluates attacker-influenced header content. It was fixed in March 2017 and exploited in the wild within days. It is in CISA's KEV catalog, and still turns up in forgotten internal applications and bundled products. Am I affected: - Struts 2.3.5 through 2.3.31 and 2.5 through 2.5.10 per the Apache bulletin (NVD ranges are wider for older 2.x). Applications using other versions are unaffected by this specific flaw. - Struts may be bundled inside a vendor product, so inventory WAR/JAR files: look for struts2-core-*.jar in deployed applications and software bills of materials, e.g. find / -name 'struts2-core*.jar'. Check the version in the file name. Fix: 1. Upgrade Struts to 2.3.32 or 2.5.10.1 at minimum, and in practice to the latest supported Struts 6.x or 7.x line, since many later critical Struts flaws exist. Rebuild and redeploy the application and confirm the old jar is gone. 2. If you cannot upgrade immediately, the Apache bulletin gives two interim options: switch to a different Multipart parser implementation, or add a servlet filter that rejects requests whose content type is not multipart/form-data. These are stopgaps. 3. For bundled products, apply the vendor's patch; NVD lists many vendor products that embed Struts. 4. If an exposed, unpatched instance existed, hunt for unknown JSP/WAR files in the web root, unexpected child processes of the application server, new accounts or cron jobs, and outbound connections. Rebuild the host from a clean image and rotate the application's database and API credentials. Verify: the deployed struts2-core jar is 2.3.32 / 2.5.10.1 or newer (ideally a current release), and a scan of your estate finds no older copies. Sources: https://cwiki.apache.org/confluence/display/WW/S2-045 https://nvd.nist.gov/vuln/detail/CVE-2017-5638 https://www.cisa.gov/known-exploited-vulnerabilities-catalog