Exploit for CVE-2024-53677

kitploit · 2026-09-02

Description

File upload path traversal in Apache Struts enabling Remote Code Execution.

Entry point

Parametertop.UploadFileName · request body

Path/upload.action

File upload parameter can be manipulated to perform path traversal and upload a malicious file leading to RCE (via old FileUploadInterceptor).

Affected Apache Struts versions

Apache Struts< 6.4.0

All known vulnerabilities by product

CVSS 9.8 for CVE-2024-53677

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:HIGH

Attack Requirements:PRESENT

Privileges Required:NONE

User Interaction:NONE

CVE Information

Exploit Details

Modified:2026-09-02 15:57

Last Seen:2026-09-04 23:39

Reporter:KitPloit

Tags

Apache Strutspath traversalfile uploadRemote Code ExecutionPoC exploit

Other exploits for CVE-2024-53677

CVE-2024-53677-S2-067

2026-09-04 KitPloitKITPLOIT

2026-09-04 KitPloitKITPLOIT

s2-067-CVE-2024-53677

2026-09-04 KitPloitKITPLOIT

CVE-2024-53677-S2-067-thread

2026-09-04 KitPloitKITPLOIT

struts-uploader-vulnerability

2026-09-04 KitPloitKITPLOIT

2026-09-04 KitPloitKITPLOIT

2026-09-04 KitPloitKITPLOIT

CVE-2024-53677-Analysis

2026-09-04 KitPloitKITPLOIT

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CTFSEC-CVE-2024-53677
# CVE-2024-53677

Эксплойт для доказательства концепции уязвимости CVE-2024-53677 — уязвимость обхода пути при загрузке файлов в Apache Struts, приводящая к удаленному выполнению кода.