Back to the CVE list
CVE-2017-9805 CISA KEV · Actively exploited

struts: RCE attack via REST plugin with XStream handler to deserialise XML requests

CVSS score

8.1

EPSS probability

%99.4

Risk score

16.1

Published

9 y ago

OverviewPublic Exploits (22)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
mazen160/struts-pwn_CVE-2017-9805
GitHub

An exploit for Apache Struts CVE-2017-9805 (★247)

Public PoCSource updated: 28.04.2022 18:29:58
G
luc10/struts-rce-cve-2017-9805
GitHub

CVE 2017-9805 (★58)

Public PoCSource updated: 04.05.2022 15:07:53
G
chrisjd20/cve-2017-9805.py
GitHub

Better Exploit Code For CVE 2017 9805 apache struts (★22)

Public PoCSource updated: 14.04.2022 19:34:14
G
0x00-0x00/-CVE-2017-9805
GitHub

Exploit script for Apache Struts2 REST Plugin XStream RCE (‎CVE-2017-9805) (★15)

Public PoCSource updated: 27.01.2022 02:27:10
G
Lone-Ranger/apache-struts-pwn_CVE-2017-9805
GitHub

An exploit for Apache Struts CVE-2017-9805 (★5)

Public PoCSource updated: 03.12.2021 08:16:55
G
hahwul/struts2-rce-cve-2017-9805-ruby
GitHub

cve -2017-9805 (★3)

Public PoCSource updated: 19.07.2021 13:12:18
G
BeyondCy/S2-052
GitHub

CVE-2017-9805 - Exploit (★1)

Public PoCSource updated: 24.11.2020 23:16:12
G
UbuntuStrike/struts_rest_rce_fuzz-CVE-2017-9805-
GitHub

Simple python script to fuzz site for CVE-2017-9805 (★1)

Public PoCSource updated: 01.09.2019 08:36:02
G
0xd3vil/CVE-2017-9805-Exploit
GitHub

CVE-2017-9805-Exploit (★1)

Public PoCSource updated: 30.08.2021 11:47:38
G
UbuntuStrike/CVE-2017-9805-Apache-Struts-Fuzz-N-Sploit
GitHub

A script to Fuzz and and exploit Apache struts CVE-2017-9805 (★0)

Public PoCSource updated: 18.06.2020 11:43:56
G
wifido/CVE-2017-9805-Exploit
GitHub

Struts 2.5 - 2.5.12 REST Plugin XStream RCE (★0)

Public PoCSource updated: 04.04.2021 13:33:56
G
jongmartinez/-CVE-2017-9805-
GitHub

Exploit script for Apache Struts2 REST Plugin XStream RCE (‎CVE-2017-9805) (★0)

Public PoCSource updated: 28.11.2020 09:34:46
G
z3bd/CVE-2017-9805
GitHub

struts2-rest-showcase 2.5.10 (★0)

Public PoCSource updated: 06.03.2021 08:26:32
G
Shakun8/CVE-2017-9805
GitHub

CVE-2017-9805 POC (★0)

Public PoCSource updated: 03.10.2022 09:16:40
G
NoSpaceAvailable/CVE-2017-9805_example_build
GitHub

Example web application that run on struts2 REST plugin 2.5.8, for demonstration purpose only (★0)

Public PoCSource updated: 14.12.2025 04:13:24
E
Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution
Exploit-DB

Apache Struts 2.5 < 2.5.12 - REST Plugin XStream Remote Code Execution

Exploit referenceSource updated: 06.09.2017 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-9805.yaml
Nuclei

Nuclei: Apache Struts2 S2-052 - Remote Code Execution

Exploit reference
G
7s26simon/CVE-2017-9805-S2-052
GitHub

CVE-2017-9805 S2-052 PoC

Public PoC
G
agent3137/CVE-2017-9805-Exploit
GitHub

CVE-2017-9805-Exploit

Public PoC
G
Experience-rookie/struts-s2-052-deserialization-rce-lab
GitHub

Proof-of-Concept exploit for Apache Struts S2-052 (CVE-2017-9805) XML Deserialization Remote Code Execution. Created while solving the INE eWPTX Practice Range lab. Includes custom payloads, reverse shell exploit script, and step-by-step exploitation examples.

Public PoC
G
Fl5xia/CVE-2017-9805
GitHub

CVE-2017-9805: Apache Struts 2 S2-052 RCE Exploit - PoC for Harvard University (OTD)

Public PoC
G
RaniaMathlouthi/cve-2017-9805-struts-lab
GitHub

RaniaMathlouthi/cve-2017-9805-struts-lab

Public PoC

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2017-9805"