Apache Struts2 file upload RCE under active exploitation

9 June 2026 high vulnerability technology

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

File upload path traversal in Struts2 allows remote code execution; active exploit activity reported.

A path traversal vulnerability in Apache Struts2's file upload handling allows attackers to manipulate upload parameters and write malicious files to arbitrary locations, leading to remote code execution in the context of the affected service account. The vulnerability affects Struts 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.3.0.2. SANS has observed active exploit attempts originating from 169.150.226.162.

Successful exploitation permits RCE with the privileges of the Struts service account; depending on service configuration, this can enable program installation, data access or deletion, and account creation. The attack vector is file upload manipulation; no user interaction is required beyond the ability to submit uploads to an affected application.

Defenders must upgrade to Struts 6.4.0 or later and migrate away from the legacy FileUploadInterceptor. Applications not using the vulnerable upload logic are unaffected. Least-privilege service accounts, network segmentation, vulnerability scanning, and exploit protection features limit impact.

Mentioned in this report

Vulnerabilities CVE-2024-53677

Detection guidance

Struts2 Upload Parameter With Path Traversal in Request Query

ATT&CK T1190

Web request whose query string carries a Struts-style upload FileName parameter together with directory traversal sequences, consistent with Struts2 file upload path traversal exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Struts2 Upload Parameter With Path Traversal in Request Query
id: 62a1edf1-e78e-5112-a1d7-0e02077d35dc
status: experimental
description: Detects web requests where the query string contains a Struts-style upload
  FileName parameter combined with directory traversal sequences, consistent with
  exploitation of the Struts2 FileUploadInterceptor path traversal. Multipart body
  parameters are not visible in access logs, so this only catches variants that pass
  the parameters in the URL.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: FileName
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%2e%2e%5c'
  condition: selection_param and selection_traversal
falsepositives:
- Vulnerability scanners run by the internal security team against Struts applications
- Applications that legitimately pass relative file paths in a FileName query parameter
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141

Java Application Server Spawning Shell With Reconnaissance or Download Commands

ATT&CK T1190

A Java process (Tomcat/Struts host) spawning a shell that runs recon or download commands, indicating post-exploitation RCE after web application exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Application Server Spawning Shell With Reconnaissance or Download Commands
id: 847cf946-dee3-59eb-9238-35964d420da7
status: experimental
description: Detects a Java process on Linux spawning a shell whose command line runs
  recon, download, or reverse-shell style commands. This is the typical post-exploitation
  pattern after RCE through a Struts2 upload flaw running as the service account.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - 'id '
    - uname
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - 'nc '
    - useradd
    - /etc/passwd
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Java based build or deployment tools such as Jenkins running shell steps that call
  curl or wget
- Application startup scripts launched by a Java wrapper that call uname or id
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141

Java Process Writing JSP File Into Web Application Directory

ATT&CK T1190

java.exe or Tomcat service creating a .jsp/.jspx file under webapps or ROOT, matching webshell drop via arbitrary file write in upload handling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Writing JSP File Into Web Application Directory
id: aec161fc-1a7a-5f73-9966-38085b740b14
status: experimental
description: Detects a Java or Tomcat process creating JSP/JSPX files inside web application
  directories on Windows, consistent with a webshell written through Struts2 file
  upload path traversal.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat9.exe
    - \tomcat8.exe
    - \tomcat10.exe
    TargetFilename|contains:
    - \webapps\
    - \ROOT\
    TargetFilename|endswith:
    - .jsp
    - .jspx
  condition: selection
falsepositives:
- Legitimate application deployment or WAR auto-unpacking by Tomcat writing bundled
  JSP files
- Developers hot-deploying JSP changes on non-production servers
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141

1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs