-
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
Sep 19, 2026 · Domain: Endpoint Domain: Web Domain: Network OS: Linux Use Case: Threat Detection Tactic: Initial Access Tactic: Persistence Data Source: Elastic Defend Data Source: Network Traffic Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Web Shell Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Data Source: Network Packet Capture Service: Apache HTTP Server Vuln: CVE-2023-50164 ·Identifies successful exploitation of CVE-2023-50164, a critical path traversal vulnerability in Apache Struts 2 file upload functionality. This high-fidelity rule detects a specific attack sequence where a malicious multipart/form-data POST request with WebKitFormBoundary is made to a Struts .action upload endpoint, immediately followed by the creation of a JSP web shell file by a Java process in Tomcat's webapps directories. This correlated activity indicates active exploitation resulting in remote code execution capability through unauthorized file upload and web shell deployment.
Read More